OT Security Lessons from the U.S. Water Systems Cyberattacks

flowchart LR
    A["Internet"] -->|Port 44818| B["Exposed PLC"]:::redNode
    B --> C["Water Pump"]:::grayNode
    D["Secure Gateway"] -->|VPN/ACL| E["Protected PLC"]:::greenNode
    E --> F["Water Pump"]:::blueNode
    
    classDef redNode fill:#dc2626,color:#ffffff,stroke:#7f1d1d,stroke-width:2px;
    classDef greenNode fill:#16a34a,color:#ffffff,stroke:#14532d,stroke-width:2px;
    classDef blueNode fill:#2563eb,color:#ffffff,stroke:#1e3a8a,stroke-width:2px;
    classDef grayNode fill:#64748b,color:#ffffff,stroke:#334155,stroke-width:2px;

In late July 2026, a coordinated wave of cyberattacks targeted critical operational technology (OT) across the U.S. Water and Wastewater Systems (WWS) sector. Threat actors didn’t rely on highly sophisticated zero-day exploits; instead, they scanned the public internet for exposed Programmable Logic Controllers (PLCs) and simply logged in. The immediate result was a loss of control visibility, forcing several municipal facilities to revert to manual operations to prevent flooding and maintain water pressure.

Key Takeaways

• The July 2026 U.S. water systems cyberattacks specifically targeted internet-exposed Rockwell Automation MicroLogix 1100 and 1400 PLCs.
• Attackers changed IP addresses and altered ladder logic to lock out legitimate operators.
• Defending against these attacks requires removing PLCs from the public internet and implementing strict access control lists (ACLs).

The Mechanics of the Attack

According to the joint advisory issued by the FBI, EPA, and CISA, the attackers primarily focused on legacy equipment, particularly the Allen-Bradley MicroLogix series, which were connected directly to the internet without intermediate firewalls or VPNs. Once the attackers identified an open port—commonly port 44818 for Ethernet/IP—they accessed the devices, modified administrative passwords, and changed the PLC network settings. This effectively severed the connection between the PLC and the plant’s centralized Human-Machine Interface (HMI).

Engineers on the plant floor know that legacy PLCs were designed for closed, trusted networks, not for defending against brute-force attacks from the public web. They lack modern cryptographic authentication natively. When a PLC is exposed to the internet, any actor with a basic port scanner can interact with its communication stack.

flowchart TD
    subgraph attack_vector ["Attack Vector"]
        A["Threat Actor"] -->|Scans Port 44818| B["Internet-Facing Cellular Modem"]
        B --> C["MicroLogix PLC"]:::vulnNode
        C -->|Changes IP & Password| D["Operator Locked Out"]:::impactNode
    end
    
    classDef vulnNode fill:#dc2626,color:#ffffff;
    classDef impactNode fill:#f59e0b,color:#ffffff;

Why Cellular Modems Are a Weak Link

A recurring theme in the U.S. water systems cyberattacks is the misuse of cellular modems. Remote pump stations and lift stations often rely on 4G/5G modems for telemetry backhaul. Integrators sometimes configure these modems with public static IP addresses for easier remote maintenance. If port forwarding is enabled to point directly to the PLC’s internal IP, the PLC becomes accessible to anyone on the internet.

This configuration bypasses enterprise firewalls completely. A secure architecture requires the cellular modem to establish a secure tunnel (like IPsec or OpenVPN) back to the central SCADA network, ensuring that the PLC is only accessible from within the trusted corporate boundary.

Immediate Mitigation Strategies

The CISA advisory leaves no room for debate: OT devices must not be directly accessible from the internet. Implementing the following steps is mandatory for securing OT infrastructure against opportunistic scanning.

Modernizing OT Security

While isolating legacy PLCs is the immediate fix, the long-term solution involves migrating to modern hardware that supports secure communication protocols natively. New PLCs offer features like encrypted web servers, certificate-based authentication (such as OPC UA with X.509 certificates), and role-based access control directly on the controller.

However, replacing hardware takes time and capital. For existing installations, adding an industrial firewall or a secure edge gateway in front of the PLC provides the necessary layer of defense without requiring a costly rip-and-replace of the control logic. To learn more about modernizing your infrastructure, browse our AutomationView Store for tools and templates designed for secure, scalable automation.

Conclusion

The recent U.S. water systems cyberattacks serve as a stark reminder that security by obscurity is a failed strategy. Attackers are actively scanning for vulnerable OT assets. By auditing remote connections, securing cellular backhauls, and enforcing strict network segmentation, automation engineers can protect critical infrastructure from these preventable disruptions.

FAQ

Why were MicroLogix PLCs specifically targeted?

MicroLogix PLCs are widely deployed in remote water facilities due to their cost-effectiveness and reliability. Because they are older architectures, they lack robust native cybersecurity features, making them easy targets if connected directly to the internet.

How do I know if my PLC is exposed to the internet?

You can use external scanning tools or services like Shodan to check your public IP blocks for open industrial ports (e.g., 44818 for Ethernet/IP, 502 for Modbus TCP). Internally, review the configuration of all edge routers and cellular modems for active port forwarding rules.