CISA warns of cyberattacks disrupting U.S. water utilities

Attackers are exploiting programmable logic controllers (PLCs) in water and wastewater systems that are directly accessible from the public internet — a fundamental security misconfiguration that should never exist in critical infrastructure. By gaining access to these exposed devices, threat actors were able to change passwords, alter IP addresses, and disrupt operations across more than 30 Minnesota community water systems. This incident highlights that operational technology (OT) environments require strict isolation from the internet, as these systems were designed for reliability, not cyber resilience. The consequences of compromised water infrastructure extend beyond IT disruption to direct public health and safety risks, making this a critical national security concern.