Water plant PLC cyberattacks follow US government warnings about Iran
31 July 2026 
UPDATED: Water utilities in the US have suffered a series of cyberattacks on their PLC-based control and monitoring systems, shortly after US government agencies issued renewed and expanded warnings about possible cyberattacks by “Iran-affiliated cyber-actors” on PLCs used in critical applications.
Cyberattacks targeting municipal water systems have been reported in at least seven US states – with more than 30 in Minnesota alone – resulting in customers being told to boil water, and the need to operate the plants manually.
An alert issued by the FBI (Federal Bureau of Investigation) and the EPA (Environmental Protection Agency) on 30 July said that the attackers were targeting OT (operational technology) devices including Rockwell Automation Allen-Bradley PLCs – specifically the MicroLogix 1100 and 1400 series. After accessing the Internet-connected devices remotely, they changed IP address and passwords, resulting in a loss of monitoring and control functions.
Effects reported to the FBI have included loss of pressure and flooding. Pressure losses can potentially allow untreated groundwater to seep into pipes. Once a system has been compromised, the impact depends the model of PLC and the functions it supports, whether it was configured for monitoring or controlling, and the ability to switch to manual operations.
At least one organisation reported that its PLC project files had been modified, after it noticed ladder logic discrepancies across several sites. The FBI/EPA alert said that, for several victims, similarities in network set-ups provided by third parties may provide MCAs (malicious cyber actors) “the opportunity to multiply successes when vulnerable network and hardware set-ups exist across customers”.
The FBI did not place blame for the cyberattacks, although President Trump pointed the finger at the Democrat-led administration in Minnesota.
In a separate alert, the US government’s Cisa (Cybersecurity and Infrastructure Security Agency) said it was observing a “significant” increase in cyber-threat actors targeting PLCs in the water and wastewater sector. It urged owners, operators and system integrators to remove publicly exposed PLCs and other OT equipment from the Internet “as soon as possible”.
Earlier, on 22 July, a group of US government agencies – including the NSA (National Security Agency), the DOE (Department of Energy), the CNMF (Cyber National Mission Force) and the Department of the Treasury, as well as the FBI, EPA and Cisa – issued an “urgent” warning about possible cyberattacks by “Iran-affiliated cyber-actors” on PLCs used in critical applications across the US. This followed an earlier warning, in April, that US automation users should look for signs of current or historical activity on their networks, and apply mitigations to reduce the risk of compromise.
The new warning reported that PLC operations have been disrupted across several US critical infrastructure sectors through malicious project file interactions and manipulation of data on HMI and Scada displays, resulting in disruption and financial losses.
The update added guidance on detecting malicious changes in re-usable code modules in Rockwell Automation PLC programs. It also expanded the scope to include the targeting of Schneider Electric, Siemens and potentially other makes of PLC, emphasising the importance of restricting direct Internet access to these controllers and offering best practices for minimise the risks.
The agencies say they have observed Iranian-affiliated APT (advanced persistent threat) actors using configuration software – such as Rockwell Automation’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ Totally Integrated Automation (TIA) Portal – running on leased, third-party-hosted infrastructure to connect to victim’s PLCs and extract project files. After the files were extracted, the FBI and Cisa found that they were modified and deleted to include Add-On Instructions (AOIs) and to manipulate data on HMI and Scada displays. In addition, the changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators about the anomalies. (An AOI is similar to a function block in PLC programs.)
At one victim, analysis indicated that the modified project file retained ladder logic for downstream functions but added logic that overrode specific instruction sets responsible for maintaining safe operating parameters.
The devices being targeted include: Rockwell Automation CompactLogix and Micro850 PLCs (as well as the MicroLogix range); Schneider Electric BMX P34/Modicon M340 PLCs; and Siemens S7-1200 PLCs.
Due to the widespread use of these PLCs, and the potential for targeting of other OT devices used in critical infrastructure, the agencies are recommending that US organisations urgently review the TTPs (tactics, techniques and procedures) and IOCs (indicators of compromise) in the advisory for indications of current or historical activity on their networks, and apply the recommended mitigations to reduce the risk of compromise.
If owners and operators discover an affected Internet-accessible device, they should implement their cyber-incident response plans and contact the government agencies and equipment suppliers for advice on support, mitigation and investigation assistance.
The government agencies recommend that PLC users should:
- remove PLCs from direct Internet exposure via secure gateways and firewalls;
- ensure that device passwords are complex, unique combinations of letters, numbers and symbols;
- strictly control network access to PLCs;
- practice and maintain the ability to operate OT systems manually;
- review project files running on PLCs for unauthorised changes;
- plan to replace end-of-life devices which manufacturers are no longer selling, supporting or offering software updates or security patches;
- query logs for IOCs and check them for suspicious traffic on the ports associated with OT devices, especially traffic originating from foreign hosting providers; and
- for Rockwell PLCs, they should place the physical mode switch into the run position.
