CISA Warns of Attacks on Exposed PLCs After Disruptions at Minnesota Water Systems
Summary
CISA warns that attackers are targeting internet-exposed PLCs in water systems. Minnesota officials reported disruptions at more than 30 community systems, with some switching to manual operations. CISA advises removing direct internet exposure or securing access.
Key points
- CISA says attackers have targeted exposed PLCs, changing passwords and IP settings to lock out operators or disrupt operations.
- Minnesota IT Services reported a coordinated attack affecting more than 30 community water systems; equipment problems forced some utilities to switch temporarily to manual operations.
- CISA urges operators to remove PLCs and other OT from direct internet exposure, or use VPNs or gateways, change default passwords, and restrict access with IP allow-lists.
- CISA warns that undocumented cellular modems can leave OT assets exposed.
- Censys estimated more than 4,100 internet-exposed Rockwell/Allen-Bradley hosts, 4,100 Siemens hosts, and over 2,000 Schneider Electric hosts; public reachability does not establish targeting or compromise.
- CISA directed MicroLogix 1400 PLC operators to vendor guidance for recovering access if passwords have been changed.
Article Details
- Event Type
- Cyberattacks targeting internet-exposed programmable logic controllers in water and wastewater systems
- Impact
- More than 30 Minnesota community water systems were disrupted. Reported actions included changing passwords to lock operators out and modifying IP settings; equipment malfunctions forced some utilities to temporarily switch to manual operations.