CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs

Threat actors are actively targeting internet-exposed Programmable Logic Controllers (PLCs) in the Water and Wastewater Systems sector, exploiting default or weak credentials to lock out legitimate operators and manipulate device configurations. The root problem is a combination of poor network segmentation — leaving OT devices directly accessible from the internet — and inadequate access control policies such as unchanged default passwords. These attacks have real-world physical consequences, including boil water advisories that endanger public health. Critical infrastructure operators often underestimate the cyber risk to OT environments, mistakenly assuming air-gapping or obscurity provides sufficient protection. This incident underscores that OT security must be treated with the same rigor as IT security, especially as legacy industrial systems increasingly gain internet connectivity.