CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks
CISA reports over 100 internet-exposed water systems targeted by Iran-linked hackers in July.
CISA has revealed that over 100 internet-exposed water and wastewater systems were targeted in cyberattacks during July. The attacks, linked to Iranian threat actors, primarily exploited programmable logic controllers (PLCs) connected via cellular modems to disrupt operational technology. While no significant disruptions were reported, CISA has issued guidance urging organizations to reduce internet exposure of critical infrastructure systems.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Siemens?
Get an email when a new story names Siemens, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonOver 100 water and wastewater systems were targeted because their operational technology (OT) — specifically programmable logic controllers (PLCs) — was directly accessible from the internet via cellular modems, creating an easily exploitable attack surface. This reflects a fundamental configuration failure: critical industrial control systems should never be reachable from public networks without strict access controls and segmentation. The fact that Iranian state-linked actors were able to identify and target these systems at scale suggests they are being actively enumerated through tools like Shodan. While disruptions were limited this time, successful manipulation of water treatment systems could have serious public health consequences. This incident underscores the urgent need for OT/ICS environments to adopt network isolation principles standard in IT security.
What helps against this
How we list vendors- External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.