Water and Wastewater Cybersecurity Research Brief

Operations

Aug 10

Written By

Executive finding

The most important current development is the FBI and EPA warning issued on July 30, 2026. Since July 27, water and wastewater utilities in at least seven U.S. states have reported incidents involving internet-facing MicroLogix 1100 and 1400 programmable logic controllers. The actors changed device IP addresses and passwords, causing a loss of monitoring and control; reported effects included pressure loss and flooding, and one organization found modified project files and ladder-logic discrepancies. The agencies did not publicly attribute this campaign.

The evidence does not support presenting the issue as a failure of a single product, a single integrator, or the water sector as a whole. It supports a more useful conclusion: an exploitable operational condition emerges when device exposure, weak configuration, repeatable third-party architecture, inadequate integrity assurance, and limited recovery readiness intersect.

Confirmed attack picture

Cyber risk also reaches water utilities through enterprise IT, ransomware, data theft, suppliers, and service providers. For example, American Water Works disclosed unauthorized activity in its computer networks in October 2024 and activated incident-response and containment procedures. These events should not be described as direct manipulation of water treatment unless the relevant operator or an authoritative agency confirms that fact.

Where current guidance converges

The market has no shortage of tools. Current government and sector guidance converges on a smaller set of operating outcomes:

Remove direct public exposure from PLCs, HMIs, engineering workstations, and remote-access services.
Mediate necessary access through controlled gateways or jump hosts, with strong identity, least privilege, logging, monitoring, and an isolation plan.
Maintain a validated OT asset inventory and a definitive view of architecture, connectivity, external pathways, and third-party dependencies.
Eliminate default and shared credentials, use multifactor authentication where technically feasible, and protect privileged engineering access.
Baseline controller projects, firmware, network settings, reusable logic, and I/O configurations, then verify the running state against approved known-good versions.
Track vendor advisories, known-exploited vulnerabilities, product lifecycle status, and compensating controls, but prioritize them based on reachability and operational consequences.
Validate backups before use and test restoration, loss-of-view procedures, manual operation, incident escalation, and safe isolation.
Assess vendors, integrators, cellular providers, and managed service providers as part of the operational architecture, not as a procurement afterthought.
Use passive and engineering-led discovery first. Any active testing in OT should be planned with operations, tested where possible, approved through change control, and supported by rollback procedures.
Treat assessment as a recurring assurance process with accountable owners and evidence of closure, not as a one-time checklist.

EPA reported in February 2026 that its Office of Water had identified 277 vulnerabilities in 2025 and helped eliminate 350.

The agency emphasized that many improvements were free or low-cost, including authentication, access restrictions, reduced public exposure, and asset inventory. That is an important positive message: material risk reduction is achievable even when capital budgets and specialist staffing are limited.

Find the Weakness Before the Attacker Finds the Path

A practical assessment agenda for water and wastewater operators

In my previous article, When One Remote Path Becomes Seven States of Risk, I argued that a repeated remote-access design can turn a local weakness into a multi-utility problem. The next question is practical: how does an operator establish which vulnerabilities exist, which could affect the process, and what should be corrected first?

The answer cannot begin and end with a scanner. Product names and severity scores do not show whether a device is reachable, controls a critical process, has independent protection, or can be remediated safely.

A water-sector cybersecurity assessment must connect technology to the physical service.

What have the latest incidents confirmed

On July 30, 2026, the FBI and EPA warned that water and wastewater utilities in at least seven states had reported incidents since July 27 involving internet-facing MicroLogix 1100 and 1400 programmable logic controllers.

The actors changed device IP addresses and passwords, resulting in a loss of monitoring and control. The FBI reported operational effects, including a loss of pressure and flooding. At least one organization identified modified controller project files and ladder-logic discrepancies across several sites. The agencies also observed similarities in third-party network setups across several victims, which may have allowed a successful method to be repeated.

These are confirmed facts. The agencies did not publicly attribute the campaign, and there is no basis for connecting it to a specific actor, vulnerability, integrator, or earlier campaign without additional evidence.

The consequences depended on what the PLC was doing, how it was reached, whether its settings or logic could be changed, and whether the utility could move to safe manual operation. That is the assessment model operators need.

A vulnerability is more than a CVE

In OT, vulnerability has at least four dimensions: a defect in a product or protocol; an insecure configuration, such as a default password or permissive rule; an uncontrolled architectural pathway through a modem, vendor connection, cloud gateway, or business network; and a resilience gap, such as an unverified backup or an untested loss-of-view procedure. All four matter.

One product named in the advisory, the MicroLogix 1100, was discontinued in April 2022. Lifecycle planning is necessary, but replacing it with the same exposed architecture does not eliminate the operational risk.

Hardware age is an input to the assessment. It is not the assessment.

Start with the service, not the device

The first step is to identify the essential operational functions, including treatment and chemical dosing, pumping, distribution pressure, wastewater collection, disinfection, and discharge.

For each function, operators and engineers should agree on the consequences of losing view, losing control, receiving a false value, or accepting an unauthorized change. The same technical weakness means something different on a noncritical monitoring point than on a controller capable of changing chemical dosing or interrupting a pumping sequence.

Ask five questions for every important asset:

What operational function does it support?
How can it be reached?
Who or what can change it?
What prevents or limits an unsafe consequence?
How will the utility recover if the asset or its information cannot be trusted?

Build a definitive view of the environment

An inventory exported from one monitoring tool is useful, but it is not a definitive view of OT.

Water systems often contain pathways outside the expected network boundary: cellular modems, vendor appliances, temporary engineering connections, radio links, cloud dashboards, maintenance laptops, and local ports inside field panels.

Operators should combine several evidence sources:

Drawings, controller lists, maintenance records, contracts, and telecom bills.
Interviews with operations, engineering, IT, integrators, and service providers.
Physical walkdowns of plants and remote sites.
Passive discovery plus review of network, modem, and remote-access configurations.
Controlled checks for services visible from public networks.
Engineering evidence showing model, firmware, project version, communications settings, and approved change.

The objective is an accountable record of assets, connections, owners, functions, criticality, software and firmware, lifecycle status, and recovery dependencies. Asset knowledge and connectivity knowledge belong together.

Verify every external pathway

The most urgent assessment question is simple:

Can any person or system outside the operational environment reach this asset directly or indirectly?

The answer requires more than checking the main firewall. Utilities should review cellular services, private APNs, VPNs, port-forwarding rules, remote desktop tools, vendor platforms, cloud gateways, radio networks, and third-party connections.

For every pathway, the utility should document its purpose, owner, approved users, reachable assets, authentication method, privileges, logging, monitoring, activation conditions, and isolation procedure.

Necessary remote access can be engineered safely. The current joint guidance recommends removing inbound port exposure and brokering access via a secure gateway or jump host. The decision should be risk-based and operationally justified, not reduced to a debate between unrestricted connectivity and an undefined “air gap.”

Establish controller and configuration integrity

The July incidents included reported discrepancies in the project file and ladder logic. That changes the recovery problem.

Restoring communication does not prove that the PLC is running approved logic. Reconnecting the HMI does not prove that the displayed state is accurate.

Utilities should baseline controller projects, firmware, network parameters, reusable logic, I/O configurations, HMI applications, and engineering workstation configurations. Compare the running project with the approved version using manufacturer-supported methods and qualified engineering review.

Controller modes also matter. The FBI and EPA recommend using the run position when no changes are being made, subject to manufacturer instructions and facility needs. Review the project first so that an unauthorized version is not preserved.

A backup is not trusted simply because it exists. It must be current, attributable, protected from change, and tested through controlled restoration.

Discover safely

Routine active scanning in enterprise IT can affect fragile or poorly understood OT devices. Use passive collection, documentation review, exposure analysis, and manufacturer-supported queries first. If active testing is necessary, define the target, method, timing, stop conditions, operational owner, and rollback plan under formal change control. The goal is evidence without introducing unnecessary process risk.

Prioritize by operational risk

After the weaknesses are identified, priority should be based on more than severity.

An effective decision combines:

Operational consequence if the asset is manipulated or unavailable.
Reachability and evidence of active exploitation.
Existing safeguards, segmentation, and detection capability.
Product support and lifecycle status.
Remediation risk, recovery time, and safe degraded operation.

Some findings require immediate access restriction. Others need compensating controls, engineered outages, migrations, or monitoring. Every exception should have an owner, expiry date, and evidence that the control works.

Turn the assessment into operating assurance

The assessment is complete only when the utility can demonstrate improvement.

Leadership should request evidence that public exposure has been removed, remote access is attributable, default credentials are no longer present, critical projects are baselined, backups have been validated, unsupported assets have been funded, and loss-of-view and manual-operation procedures have been exercised.

EPA offers free assessment, assistance, and training, while WaterISAC has guidance scaled for smaller systems. EPA reported helping 277 systems identify vulnerabilities and eliminate 350 weaknesses during 2025, often through free or low-cost changes.

The gap is real and manageable.

Know the path, know the process, know the recovery

Water and wastewater operators protect public health every day under financial, staffing, regulatory, and engineering constraints. Cybersecurity must support that mission. The assessment must show which assets matter, how they can be reached, whether their logic is trustworthy, what limits the consequence, and how service will continue when visibility is lost.

In the control room, that is operational knowledge. In the boardroom, there is assurance that essential service risk is understood, owned, and being reduced.

Before the next attacker finds a remote path, the operator should already know where that path ends.