CISA reports over 100 US water systems targeted by hackers in July via exposed PLCs

CISA’s advisory confirms that over 100 water and wastewater systems in the US were targeted in July, with the attacks focusing on internet-exposed programmable logic controllers. These PLCs are used to manage physical processes like pumps, valves, and alarms, making them high-value targets for disruption. The scale of the targeting, spanning multiple states and manufacturers, indicates a systematic effort rather than isolated incidents. While the attacks have not yet caused direct harm to water supplies, they have forced operators to investigate breaches and manage outages, highlighting the operational cost of even unsuccessful intrusions.

The attackers exploited vulnerabilities in PLCs from major vendors, including Rockwell, Schneider Electric, and Siemens. CISA noted that some of the intrusions involved AI-generated scripts, which were likely used to automate the exploitation of known flaws. This suggests a shift toward more scalable attack methods, where public information about industrial systems is leveraged to develop tools that can be deployed widely. The use of AI in this context does not imply sophistication in the attacks themselves but rather efficiency in targeting exposed systems at scale.

While the immediate impact has been limited to operational disruptions, the potential for physical harm exists. CISA reported that some attacks modified PLCs to disable alarms and shutdown processes, which could create unsafe conditions without operator awareness. This underscores the risk of even low-impact intrusions escalating into safety-critical failures. The fact that many affected systems are in rural or isolated areas compounds the risk, as disruptions there can have outsized effects on local populations.

US intelligence reportedly attributes the attacks to Iran, framing them as part of a broader pattern of state-sponsored cyber activity targeting critical infrastructure. This aligns with a trend of nation-state actors probing industrial control systems, whether for retaliation, reconnaissance, or future sabotage. The water sector’s reliance on legacy systems and inconsistent cybersecurity practices makes it a particularly vulnerable target. While these attacks have not yet caused catastrophic outcomes, they serve as a warning about the fragility of infrastructure that underpins public health and safety.