CISA is currently observing a significant increase in the targeting of programmable logic controllers (PLC) located in the Water and Wastewater sector. CISA is urgently recommending critical infrastructure owners and operators to remove exposed PLC devices from the internet. Please note, this exposure includes cellular modems that may be connected to your control systems.
Several dozen entities nationwide have been affected—primarily small and rural systems, though mid‑size utilities are beginning to report similar issues. No confirmed impacts to air‑gapped PLCs have been observed, though one possible case is under evaluation. Current TTPs include targeting PLCs without passwords, applying actor‑controlled passwords, and changing IP addresses, resulting in lockouts and stoppages without bricking. Specific service impacts remain under assessment, and attribution remains low‑confidence while triage continues.
While CISA is not attributing the activity to any specific threat actors, the mitigation guidance provided by the recent Joint Cybersecurity Advisory remains applicable: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastru….
To securely enable remote access to your water sites, please see the following guidance: Secure connectivity principles for Operational Technology.
If you need assistance, please contact EPA's Technical Assistance Program - Cybersecurity Technical Assistance Program for the Water Sector or your local CISA Regional Office - CISA Regions | CISA.
To report an incident to CISA, please visit the following website: Reporting a Cyber Incident | CISA.
Microsoft Teams meeting
Meeting ID: 285 653 000 692 097
Passcode: a3AN9TM7
Dial in by phone
+1 323-741-4166,,795509639# United States, Los Angeles
Phone conference ID: 795 509 639#