Review of July 2026 Attacks on U.S. Water and Wastewater Systems
Summary
A review of July 2026 attacks on U.S. water systems describes exposed PLC and remote-access weaknesses, reported operational disruptions, uncertain attribution, a mix of confirmed and unverified Canadian cases, and recommended OT defenses.
Key points
- Minnesota authorities said coordinated activity targeted OT at more than 30 community water systems on July 26–27, 2026; related activity was reported in at least seven states, including nine systems in Michigan.
- The FBI reported attackers remotely accessed exposed MicroLogix 1100 and 1400 PLCs and changed IP addresses and passwords; one organization found modified PLC project files after identifying ladder-logic discrepancies.
- Reported effects included pressure loss, flooding, communications outages, boil-water notices, and manual operation. Publicly identified utilities described varying impacts, with officials reporting no known water-quality or public-health impact in those cases.
- Authorities had not attributed the Minnesota activity. Similarities to the Iranian-affiliated PLC campaign in advisory AA26-097A are a working hypothesis, not confirmation.
- NoName057(16)'s Ontario access claim remained unverified. Saint-Noël's municipality confirmed an attack on its drinking-water station, but public evidence did not corroborate attribution to Z-Pentest; officials said water quality and service were unaffected.
- The article identifies exposed PLCs and HMIs, weak authentication, insecure cellular and third-party remote access, and legacy equipment as enabling conditions; it reports no specific zero-day as the primary access method.
- Recommended steps include removing direct internet exposure, controlling remote access with MFA and unique credentials, checking PLC logic integrity, segmenting OT, reviewing vendor access, maintaining offline backups, and testing manual operations.
Article Details
- Victim Organization
- Minnesota community water systems (more than 30 targeted; most not publicly identified)
- Incident Type
- Coordinated unauthorized access to exposed water-sector OT and PLCs, including configuration changes and reported control-logic manipulation.
- Incident Date
- 2026-07-26
- Disclosure Date
- 2026-07-30
- Operational Impact
- Minnesota authorities confirmed targeting of more than 30 community water systems on July 26–27. Reported effects across the broader activity included loss of pressure, flooding, communications outages, boil-water notices, and temporary manual operation. Braham temporarily relied on water stored in its tower; Plymouth experienced disrupted cellular communications but maintained service using manual procedures. Other identified systems and Michigan’s nine affected systems continued operating safely. No confirmed water-quality impact was reported. Separate Canadian incidents included an unverified NoName057(16) claim concerning Ontario and a confirmed Saint-Noël incident for which attribution to Z-Pentest was not publicly substantiated.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
MITRE ATT&CK
T0831The Iranian-affiliated campaign described in AA26-097A reportedly modified or deleted PLC control logic. Minnesota investigators separately found modified project files, but that activity has not been attributed to the same campaign.T0868Federal investigators identified changes disabling critical alarms and shutdown logic in the previously documented Iranian-affiliated PLC campaign.T0886Dropbear SSH on a victim modem was used to establish remote access in the previously documented Iranian-affiliated PLC activity.T1021 · Remote ServicesAttackers remotely accessed exposed PLCs and remote-access services during the late-July activity; attribution remains unresolved.
Threat Actors
CyberAv3ngersThe article reports that CyberAv3ngers compromised at least 75 Unitronics PLC and HMI devices beginning in November 2023 and replaced legitimate ladder logic with malicious code. It is discussed in connection with historical Iranian-affiliated activity, not as a confirmed actor in the July 2026 Minnesota incidents.NoName057(16)The pro-Russian hacktivist network claimed that DDoSia participants accessed an Ontario water system on July 23, 2026. The claim was not independently confirmed in the article; the group is also described as conducting DDoS attacks.Z-AllianceThe article identifies Z-Alliance as another name for Z-Pentest, which claimed access to Saint-Noël’s water system. The incident was confirmed, but the group’s responsibility was not publicly substantiated.Z-PentestThe group claimed access to Saint-Noël’s municipal drinking-water system on July 23, 2026. The municipality confirmed malicious activity at the facility, but publicly released evidence did not establish that Z-Pentest was responsible.Z-Pentest AllianceThe article identifies Z-Pentest Alliance as another name for Z-Pentest, which claimed access to Saint-Noël’s water system. The incident was confirmed, but the group’s responsibility was not publicly substantiated.
Vendors
Rockwell Automation[Device / product names ] Affected and targeted OT equipment families – Rockwell Automation MicroLogix 1100, MicroLogix 1400, CompactLogix, Micro850, Schneider Electric Modicon M340, Siemens S7-1200Schneider Electric[Device / product names ] Affected and targeted OT equipment families – Rockwell Automation MicroLogix 1100, MicroLogix 1400, CompactLogix, Micro850, Schneider Electric Modicon M340, Siemens S7-1200Siemens[Device / product names ] Affected and targeted OT equipment families – Rockwell Automation MicroLogix 1100, MicroLogix 1400, CompactLogix, Micro850, Schneider Electric Modicon M340, Siemens S7-1200Unitronics#MicroLogix1100
Products
BMX P34The previously documented Iranian-affiliated activity involved Rockwell Automation CompactLogix and Micro850 controllers, Schneider Electric BMX P34 and Modicon M340 devices, and Siemens S7-1200 PLCs.CompactLogix[Device / product names ] Affected and targeted OT equipment families – Rockwell Automation MicroLogix 1100, MicroLogix 1400, CompactLogix, Micro850, Schneider Electric Modicon M340, Siemens S7-1200EcoStruxure Control Expert[Software names ] Legitimate engineering tools used in the activity – Studio 5000 Logix Designer, EcoStruxure Control Expert, Siemens TIA Portal, RSLogix 500, RSLogix 5000, LogixPro 500Micro850[Device / product names ] Affected and targeted OT equipment families – Rockwell Automation MicroLogix 1100, MicroLogix 1400, CompactLogix, Micro850, Schneider Electric Modicon M340, Siemens S7-1200MicroLogix 1100[Device / product names ] Affected and targeted OT equipment families – Rockwell Automation MicroLogix 1100, MicroLogix 1400, CompactLogix, Micro850, Schneider Electric Modicon M340, Siemens S7-1200MicroLogix 1400[Device / product names ] Affected and targeted OT equipment families – Rockwell Automation MicroLogix 1100, MicroLogix 1400, CompactLogix, Micro850, Schneider Electric Modicon M340, Siemens S7-1200Modicon M340[Device / product names ] Affected and targeted OT equipment families – Rockwell Automation MicroLogix 1100, MicroLogix 1400, CompactLogix, Micro850, Schneider Electric Modicon M340, Siemens S7-1200S7-1200[Device / product names ] Affected and targeted OT equipment families – Rockwell Automation MicroLogix 1100, MicroLogix 1400, CompactLogix, Micro850, Schneider Electric Modicon M340, Siemens S7-1200Siemens TIA Portal[Software names ] Legitimate engineering tools used in the activity – Studio 5000 Logix Designer, EcoStruxure Control Expert, Siemens TIA Portal, RSLogix 500, RSLogix 5000, LogixPro 500Studio 5000 Logix Designer[Software names ] Legitimate engineering tools used in the activity – Studio 5000 Logix Designer, EcoStruxure Control Expert, Siemens TIA Portal, RSLogix 500, RSLogix 5000, LogixPro 500
Tools
DDoSiaOn July 23, 2026, the pro-Russian hacktivist network NoName057(16) claimed that participants in its DDoSia project had gained access to a water system in Ontario.Dropbear SSHon controllers and modems to preserve access or disrupt recovery (‘modified PLC project files’ and ‘Dropbear SSH on a victim modem’).
Countries
CanadaRecent attacks on water and wastewater systems in Minnesota, Michigan, Canada, and elsewhere show that exposed PLCs, HMIs, cellular modems, and weak remote-access setups can allow attackers to disrupt physicalIranAlthough the campaigns share important technical characteristics, the Minnesota incidents and the wider multistate activity have not yet been formally attributed to Iran or to a named threat group.