[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frmrKq9bwed3ci-cq5ksmtV39L6CKdtg6J3NidCPeFIM":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"fe814887-fe89-4c85-81e9-a581253e8132","CISA warns of cyberattacks disrupting U.S. water utilities","cisa-warns-of-cyberattacks-disrupting-u-s-water-utilities-0bef39","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a significant increase in attacks targeting internet-exposed programmable logic controllers (PLCs) in the water and wastewater systems sector. [...]","CISA has issued a warning about a surge in cyberattacks targeting internet-exposed PLCs in US water and wastewater systems. These attacks, which have already disrupted over 30 community water systems in Minnesota, involve hackers changing passwords, modifying IP addresses, and causing operational disruptions. CISA strongly advises removing these operational technology assets from direct internet exposure.","CISA warns of increased cyberattacks targeting US water utilities' PLCs.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisa-warns-of-cyberattacks-disrupting-us-water-utilities\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2023\u002F08\u002F11\u002Findustrial-control-system.jpg","2026-07-31T16:49:49+00:00","2026-07-31T18:00:27.097108+00:00",9,[17,20,22,24,27,30],{"name":18,"type":19},"Rockwell Automation","vendor",{"name":21,"type":19},"Siemens",{"name":23,"type":19},"Schneider Electric",{"name":25,"type":26},"MicroLogix 1400","product",{"name":28,"type":29},"programmable logic controllers","technology",{"name":31,"type":29},"operational technology","d6f63bb8-0801-486a-be7f-171400700454",{"id":32,"icon":34,"name":35,"slug":36},null,"IoT\u002FOT","iot-ot",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21,23],{"controls":58,"vendors":146},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-private-access","Netskope Private Access","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fprivate-access","Zero trust access to private applications.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-access","Cloudflare Access","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Faccess\u002F","Zero trust access to internal applications without a VPN.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-private-access","Zscaler Private Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-private-access","Zero trust access to private applications, replacing VPN.",{"slug":89,"name":90,"problem":91,"products":92},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"slug":118,"name":119,"problem":120,"products":121},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":162},"internet-exposed-plcs-in-water-utilities-under-active-attack","Internet-Exposed PLCs in Water Utilities Under Active Attack","Attackers are exploiting programmable logic controllers (PLCs) in water and wastewater systems that are directly accessible from the public internet — a fundamental security misconfiguration that should never exist in critical infrastructure. By gaining access to these exposed devices, threat actors were able to change passwords, alter IP addresses, and disrupt operations across more than 30 Minnesota community water systems. This incident highlights that operational technology (OT) environments require strict isolation from the internet, as these systems were designed for reliability, not cyber resilience. The consequences of compromised water infrastructure extend beyond IT disruption to direct public health and safety risks, making this a critical national security concern.",[152,153,154,155,156,157,158,159,160,161],"CIS Control 12 – Network Infrastructure Management","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","NIST SP 800-82 – Guide to ICS Security","NIST AC-3 – Access Enforcement","NIST SC-7 – Boundary Protection","NIST IR-6 – Incident Reporting","ICS-CERT Recommended Practices for Securing ICS","CISA Cross-Sector Cybersecurity Performance Goals (CPGs) – CPG 1.A, 2.B","America's Water Infrastructure Act (AWIA) Section 2013 – Cybersecurity Risk Assessment Requirements",{}]