The Short Version
Since July 27, water and wastewater utilities across at least seven states, and reportedly as many as twelve, have reported cyberattacks against the programmable logic controllers that run pumps, valves, and treatment equipment. Utilities have reported pressure loss and flooding, and one Minnesota community, Maple Plain, declared a local state of emergency. The utilities that caught it fast switched to manual operations and kept water safe. Several stayed there for days.
None of it required a sophisticated exploit. Attackers found controllers reachable from the public internet, many running firmware years out of date, logged in, changed the IP address and password, and locked operators out of their own equipment. In at least one case they rewrote the ladder logic controlling the equipment itself.
A follow-up scan found 4,407 of these controllers exposed to the internet worldwide, including 22 sitting in cities already hit by this campaign. The vulnerability wasn’t the point. The exposure was.
The Attack
The controllers involved are Rockwell Automation MicroLogix PLCs, mostly the 1400 series and the 1100, which Rockwell discontinued in 2022. They communicate over EtherNet/IP on port 44818, a protocol with no authentication built in by default. If a controller answers on that port from the open internet, anyone who finds it can query its identity and, depending on configuration, write settings directly to it. No credentials required to get that far.
The pattern has been consistent across affected utilities: attackers changed the controller’s IP address, reset the password, and in some cases rewrote the ladder logic itself, the actual program controlling pumps and valves. Operators lost visibility first, then in some cases lost control. More than 70% of the exposed US controllers found in a follow-up scan were sitting on cellular carrier networks, connected through mobile modems that utilities and their integrators had assumed were private simply because they weren’t on the office network.
Nineteen of 22 controllers found in affected cities were also running firmware susceptible to CVE-2017-16740, a Modbus TCP buffer overflow Rockwell patched back in 2017 (CVSS 8.6). That’s real and worth fixing, but Rockwell’s own guidance on it makes the more important point: patching it doesn’t make direct internet exposure acceptable. A fully patched controller sitting on the open internet with a default password is still an open door.
Treat every internet-reachable PLC as compromised until proven otherwise. If your inventory says “we don’t think any controllers are exposed,” that assumption is exactly what this campaign has been testing.
Ten Days, A Dozen States
First reports
FBI and EPA issue joint advisory
Scale confirmed independently
Scope still moving
The final count may not be settled for weeks. Regardless of where it lands, the fix is the same at every affected site: a controller that should never have been reachable from the internet, was.
Why This Isn’t a Patching Problem
This is what separates this campaign from a routine CVE advisory. There isn’t one.
A buffer overflow patched in 2017 shows up in most of the affected controllers, but exploiting it wasn’t necessary and, in most cases, wasn’t even attempted. Attackers didn’t need code execution. They needed a controller that answered on the internet and a password nobody had changed. Patch schedules don’t fix that. Firmware updates don’t fix that. Only removing the exposure does.
A fully patched PLC on the open internet is still an open door.
Updating firmware closes known code-execution paths. It does nothing about a controller that will accept a connection, and a login attempt, from anyone on earth. Until the controller is off the public internet, patch status is beside the point.
This also isn’t the first time. In late 2023, attackers compromised similarly exposed controllers at utilities in several states, including the widely reported incident in Aliquippa, Pennsylvania. What’s changed since is scale and repeatability: third-party integrators often deploy the same remote-access configuration across many small utility customers at once, so compromising one setup hands attackers a template for the next twenty. That pattern is showing up in this campaign too. The FBI has warned that similar third-party network setups may let attackers repeat successful compromises across customers who share the same configuration, which is why this has spread as fast as it has.
A Pattern, Not an Incident
This has landed differently in every state, but the entry point is identical everywhere it’s been traced:
Federal officials have not formally attributed the campaign. Multiple sources point toward Iran-linked activity consistent with prior targeting of US critical infrastructure.
This is the third time in three years the water sector has gotten this exact warning. Aliquippa in 2023, another wave in between, and now a dozen states at once. The utilities that came through cleanly this time weren’t running newer equipment. They’d simply already taken their controllers off the internet.
What To Do Now
Find every internet-facing PLC.
Get controllers off the public internet.
Segment OT from IT and from the internet.
Fix default and shared credentials.
Audit firewall and access-control rules.
Lock the logic.
Practice the manual failover before you need it.
Watch for the signals before operations degrade.
If a controller shows signs of tampering, treat it as an incident.
The Problem Underneath
The US has roughly 50,000 community water systems. Most look nothing like a major utility.
They’re small, publicly funded, and staffed by engineers whose job is keeping water safe and flowing, not defending a network. Cybersecurity competes for a budget that barely covers aging pipes and pumps as it is, and the PLCs at the center of this campaign are often a decade or more old, bought once, installed once, and left running with whatever configuration the integrator shipped.
No dedicated security staff
Rules governing water sector cybersecurity remain largely voluntary. There’s no equivalent of a federal patch mandate for a 1,700-person town running a MicroLogix controller from 2015. That gap is exactly what attackers are counting on, and it’s why the same failure mode keeps reappearing: 2023 in Pennsylvania, and now this, spread across a dozen states at once.
None of the fixes above require exotic technology or a large budget. They require doing the basic things: knowing what’s exposed, closing it, and rehearsing the fallback. That’s within reach for a utility of any size, and it’s the difference between the next campaign being a non-event and the next campaign being the one that makes the news.
