The water sector just got it’s wake-up call. Again.
Water utilities in seven states targeted by cyberattacks exploiting old, internet-exposed PLCs.
Water and wastewater utilities in at least seven US states have been targeted by cyberattacks exploiting internet-facing programmable logic controllers (PLCs). These attacks, which did not require sophisticated methods, involved attackers gaining access to old, unpatched devices to disrupt operations, leading to issues like pressure loss and flooding. The FBI and EPA have issued a joint alert, highlighting that these attacks were preventable due to basic security oversights, such as exposed controllers and weak credentials, and urging utilities to implement fundamental security measures.
AI summary of the linked source. Not reviewed by an editor. How this works
Run FBI?
Get an email when a new story names FBI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited internet-facing programmable logic controllers (PLCs) across water utilities in at least seven US states, leveraging unpatched devices and weak or default credentials — no sophisticated techniques required. The root failures were foundational: critical operational technology (OT) was left exposed to the public internet without hardening, patching, or strong authentication. These oversights resulted in real-world physical consequences, including pressure loss and flooding, demonstrating that cyber vulnerabilities in critical infrastructure translate directly into public safety risks. The fact that a joint FBI/EPA alert was necessary underscores how persistently the water sector lags behind on basic cyber hygiene. This is not a novel threat — it is a recurring, preventable one.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.