U.S. OT alerts target water, oil

FERC has released lessons from its 2026 fiscal audits of NERC-registered entities in the U.S. power sector. According to the reporting, the communication pointed to potential compliance findings and risks tied to artificial intelligence tools and third-party control systems, without concluding that the entire sector was out of compliance with mandatory standards.

What did FERC's CIP audits say?

FERC said, according to summaries from Morgan Lewis and McGuireWoods, that the lessons from the 2026 CIP audits covered registration of new generation facilities, aggregated generation control by affiliates or vendors, the use of AI inside environments connected to CIP-regulated networks, and third-party-related risks. McGuireWoods added that most audited entities met CIP reliability standards, although gaps remained, especially among new participants and around newer technologies such as artificial intelligence.

What incidents and exposures were seen in water?

According to Industrial Cyber, a campaign may have affected more than 30 water companies in Minnesota through internet-exposed PLCs, although the activity had not been formally attributed. At the same time, Ampyx Cyber clarified that the figure of [more than 100](https://ampyxcyber.com/blog/cisa-ot-binding-operational-directive) referred to internet-exposed water and wastewater systems that were targeted by malicious activity in July 2026, not necessarily to more than 100 compromised companies. That analysis also said many PLCs were connected directly through cellular modems.

Nozomi Networks, for its part, described an attack on a pumping station in which internet-exposed Unitronics Vision PLCs were allegedly exploited directly. In its analysis, the firm recommended close review of EtherNet/IP port 44818 in environments with Rockwell/Allen-Bradley PLCs and cited unchanged default credentials as a risk vector.

What did the oil and gas analysis show?

An analysis by Dragos cited by Industrial Cyber found that 29% of the oil and gas cases reviewed had poor IT and OT segmentation. The same work said VOLTZITE allegedly compromised cellular gateways in U.S. oil and gas infrastructure and then moved laterally to engineering workstations.

The available material did not provide an additional independent source to confirm that attribution separately. Even so, the broader picture across the reports is consistent, with misconfigured remote access, exposed control equipment and segmentation weaknesses continuing to surface in water, power, and oil and gas in the United States.