CISA Urges Water Utilities to Secure Exposed PLCs After Minnesota Attacks
Summary
CISA warns of increased targeting of water-sector PLCs and urges operators to secure internet-exposed OT. Minnesota officials reported attacks affecting more than 30 community water systems; no actor has been formally identified.
Key points
- CISA says it has observed increased targeting of water and wastewater sector PLCs and urges operators to remove exposed OT from the internet.
- CISA describes attackers changing PLC passwords to lock out operators and changing IP addresses to disconnect controllers.
- Minnesota IT Services reported attacks on OT systems at more than 30 community water systems on July 26–27; some automated controls were disrupted, but operations largely continued.
- Affected cities said drinking water remained safe. State and federal agencies are investigating, and no specific actor has been identified.
- CISA recommends disconnecting PLCs from direct internet access, routing necessary remote access through a VPN or gateway, enabling password protection, changing default passwords, and allowlisting IP addresses.
- Operators should retain a known-clean PLC image backup and review advisory AA26-097A for signs of activity.
Article Details
- Event Type
- CISA advisory urging water and wastewater operators to secure exposed PLCs, following coordinated cyberattacks on Minnesota water systems.
- Impact
- CISA reported increased targeting of water-sector PLCs, including attacks that changed passwords to lock out operators and changed PLC IP addresses to disconnect them. Minnesota IT Services said more than 30 community water systems were hit, and affected cities reported disruptions to some automated controls. Operations remained functional in most cases, and cities told residents drinking water remained safe. No formal attribution has been made.
Threat Actors
CyberAv3ngersThe article describes CyberAv3ngers as having a history of targeting small water utilities and municipal facilities. Investigators have not linked the Minnesota incidents to this group.HandalaThe article names Handala among Iranian threat groups whose profile could fit attacks on water systems, but investigators have not linked the Minnesota incidents to any specific actor.
Vendors
Rockwell AutomationThey came shortly after the US government warned critical infrastructure organizations about Iran-linked attacks on industrial control systems made by Siemens, Rockwell Automation, and Schneider Electric.Schneider ElectricThey came shortly after the US government warned critical infrastructure organizations about Iran-linked attacks on industrial control systems made by Siemens, Rockwell Automation, and Schneider Electric.SiemensThey came shortly after the US government warned critical infrastructure organizations about Iran-linked attacks on industrial control systems made by Siemens, Rockwell Automation, and Schneider Electric.
Products
Allen-Bradley controllerspublished in April, which expanded the list of targeted vendors beyond Rockwell Automation’s Allen-Bradley controllers to include Schneider Electric and Siemens devices, and noted that PLCs from other manufacturersCompactLogixInvestigators have observed activity against Rockwell CompactLogix and Micro850, Schneider Electric Modicon M340, and Siemens S7-1200 series PLCs.Micro850Investigators have observed activity against Rockwell CompactLogix and Micro850, Schneider Electric Modicon M340, and Siemens S7-1200 series PLCs.MicroLogix 1400Owners and operators of Rockwell Automation MicroLogix 1400 controllers are pointed to Rockwell’s dedicated guidance for restoring access when the password is unknown.Modicon M340Investigators have observed activity against Rockwell CompactLogix and Micro850, Schneider Electric Modicon M340, and Siemens S7-1200 series PLCs.S7-1200Investigators have observed activity against Rockwell CompactLogix and Micro850, Schneider Electric Modicon M340, and Siemens S7-1200 series PLCs.
Countries
IranThey came shortly after the US government warned critical infrastructure organizations about Iran-linked attacks on industrial control systems made by Siemens, Rockwell Automation, and Schneider Electric.Israelof targeting small water utilities and municipal facilities, and in 2020 attacks on water facilities in Israel, Iran-linked actors exploited vulnerable cellular routers as an entry point.