US Alerts on Water System Attacks

CISA and the FBI publicly warned of a significant rise in attacks against OT devices used in U.S. water systems. Reports include operators being locked out of their OT networks and malicious changes to passwords and monitoring and control settings.

Disconnecting exposed equipment

In response, CISA issued a specific alert for water and wastewater utilities. The agency urged them to disconnect PLCs and other control devices from the internet as soon as possible, and to review public IP ranges to remove direct exposure of OT systems.

Scope and affected equipment

The Wall Street Journal and El Imparcial reported that recent attacks on water and sewage systems affected at least seven U.S. states. The impact reached equipment that controls wells, pumps and water towers. In some cases, attackers changed passwords and network settings, which blocked remote control of the equipment.

Shift in technical focus

Cybersecurity Dive said the campaign expanded its focus from Rockwell Automation equipment to Schneider Electric and Siemens. That shift points to an evolution in OT targeting, with multiple industrial vendors affected across water and energy.

The official U.S. response also included public calls from CISA for water and wastewater operators to disconnect control systems from the internet as soon as possible and adopt network segmentation practices. In that coverage, the agency also released a separate advisory on Iranian actors.

International coverage from The Straits Times and Chinese-language media repeated the message and showed that the warning spread across different regions, with the same emphasis on disconnecting control systems and reducing direct OT exposure.