Water towers went dark with no warning
Over July 26 and 27, a coordinated cyberattack hit water and wastewater utilities across more than 30 Minnesota communities and, according to CISA, at least 12 U.S. states in total. Four Minnesota cities went public with specific details of what happened to their systems: Braham, Plymouth, South St. Paul, and Maple Plain. In Braham, attackers disabled computerized controls entirely, shutting down the town's well and water treatment plant for roughly two hours while staff scrambled to regain manual control. Plymouth disconnected cellular-connected equipment at its water towers and lift stations outright to contain the intrusion before it could spread further.
The broader campaign forced boil-water notices in some communities and pushed multiple utilities into extended manual operations while staff worked around control systems that had been locked out from underneath them. None of this required a novel exploit or a sophisticated custom payload built for the occasion. Attackers used the same engineering software water utility staff rely on every single day for legitimate maintenance: Rockwell Automation's Studio 5000 Logix Designer, Schneider Electric's EcoStruxure Control Expert, and Siemens' TIA Portal, all reachable simply because the underlying PLCs sat exposed directly to the open internet.
The technique: legitimate tools, illegitimate access
Once inside a given network, attackers changed administrator passwords to lock out legitimate operators, modified IP addresses to sever devices from remote monitoring dashboards, disabled safety systems outright, and manipulated operator displays, all without generating the kind of alert a traditional malware signature would normally trigger during an intrusion. Because the tools used were the vendors' own legitimate software, the activity looked, to any monitoring system not specifically tuned to watch for it, like ordinary maintenance work performed by an authorized engineer during a routine shift.
That is the core problem sitting underneath operational technology security in this sector: authentication on many of these controllers is weak or entirely absent, and the software built to configure them assumes physical or trusted-network access rather than the open internet exposure that scanning tools like Censys keep finding at scale, year after year. CISA's advisory AA26-097A, first issued earlier in the summer and updated again on July 22, documents the expanding scope of observed behavior, adding project file exfiltration and manipulation of Add-On Instructions, the reusable code modules that control core plant logic, to the list of confirmed attacker techniques.
Attribution and the geopolitical backdrop
CISA's updated advisory attributes the campaign to Iranian-affiliated threat actors operating with apparent state backing. The timing lines up closely with an active period of U.S.-Iran cyber conflict; reporting on the incident notes that hostilities between the two nations have continued since a military operation that began in late February 2026. Water and wastewater systems have been a recurring target for Iran-linked groups in prior campaigns as well, in part because these utilities are frequently under-resourced and understaffed relative to the sheer criticality of the public service they provide to surrounding communities.
This is not a one-off intrusion against a single isolated facility somewhere in the Midwest. Coordinated activity spanning more than 30 towns in one state, with confirmed effects reaching a dozen states nationally, points clearly to a scanning-and-exploitation campaign run at scale against a known, pre-catalogued set of internet-exposed devices, rather than a bespoke, targeted operation against any one specific utility chosen for strategic value. That distinction matters enormously for defenders: the attackers were not selecting targets based on importance. They were simply exploiting whatever exposed PLC their scans happened to reach first.
A five-year-old bug still doing damage
Underpinning much of the exposure is CVE-2021-22681, a critical CVSS 9.8 authentication bypass affecting Rockwell Automation's Logix controllers across multiple product lines. Rockwell has never shipped a vendor patch that actually fixes this vulnerability at the source; the only available response remains defense-in-depth mitigation, meaning network segmentation and strict access restriction rather than a genuine fix to the flawed component itself. Five years after the initial disclosure, that unresolved gap is still doing real, measurable damage inside production water infrastructure across the country today.
The Censys scan data CISA cited in its advisory is the part that should concern every water utility CIO or operations director reading this: more than 4,100 exposed Rockwell and Allen-Bradley hosts, a comparable number of exposed Siemens hosts, and roughly 2,000 exposed Schneider Electric hosts, all visible to anyone running the same internet-wide scans that attackers routinely use for reconnaissance before an operation. Nearly half of the exposed Rockwell devices were reachable over cellular connections specifically, a path many security teams still do not monitor with the same rigor they apply to their wired network perimeter.
What water utilities and their vendors need to do
CISA's mitigation guidance here is specific and genuinely achievable even for resource-constrained utilities operating on tight municipal budgets: remove PLCs from direct internet exposure immediately, require VPN or secure gateway access for any remote connection, change default passwords across every device, and implement strict IP allow-listing wherever remote access remains necessary. Where devices cannot be fully isolated from the network right away, setting the physical mode switch on a PLC to Run prevents remote logic modification even if credentials end up compromised, a low-cost control that many facilities have simply never enabled.
For enterprise technology leaders outside the water sector entirely, this incident works as a useful proxy for the broader OT security problem quietly hiding inside any organization running industrial control systems, whether that means manufacturing lines, building automation, or logistics infrastructure. The attack pattern demonstrated here, legitimate vendor tools abused against exposed devices carrying weak authentication, will recur wherever the same underlying conditions exist elsewhere. Auditing the internet exposure of every OT asset in the environment is no longer optional due diligence reserved for critical infrastructure operators. It is the single highest-leverage step available before the next scanning campaign finds what your last perimeter review missed.
