“These PLCs should not be connected to the internet,” retired Gen. Paul Nakasone, the former NSA director, told reporters at DEF CON, as attacks on water utilities’ programmable logic controllers spread to at least 12 states. “We have to have higher standards,” he said, according to The Register.
Minnesota officials were the first to report incidents. The FBI and EPA then said in a public service announcement that since July 27, water and wastewater utilities in at least seven states had reported attacks, some of which degraded operations. By early August, The Record reported, utilities in at least 12 states, including Michigan, Georgia and South Dakota, were remediating attacks. Georgia’s Clayton County Water Authority issued a precautionary boil-water advisory, since lifted.
How the attacks work
The FBI said the attackers reached internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs remotely, then changed their IP addresses and passwords, cutting off utilities’ monitoring and control. “Operational effects reported to the FBI have included loss of pressure and flooding,” the bureau said. “Pressure loss in water systems could potentially allow untreated ground water to seep into pipes.”
Federal agencies haven’t publicly attributed the attacks. Several sources point to Iran, which has targeted the same kind of equipment since 2023. A joint CISA-led advisory, first issued in April and updated July 22, warns that Iranian-affiliated actors are exploiting internet-exposed PLCs from Rockwell, Schneider Electric and Siemens across water, energy and local government systems. Nakasone said he believes the government is “taking a measured approach” to attribution, but added, “I see an actor here that has certainly shown a history of being able to do this.”
“CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLC) at water utilities,” CISA Acting Director Nick Andersen told The Record. “We urge critical infrastructure owners and operators to remove publicly exposed PLCs and other operational technology from the internet as soon as possible.”
A large, thinly staffed target
Nakasone put the scale at 50,000 water municipalities in the US, which he said supply 90% of the country’s water. Many are underfunded and have little IT staff. He pointed to DEF CON Franklin, a volunteer project launched at the conference two years ago, as one model for helping them.
The FBI and EPA’s guidance is specific: take PLCs off the public internet behind a secure gateway, secure and log the cellular modems used for remote access, set strong unique passwords, restrict PLC traffic with firewall rules or access control lists, and keep controller key switches in the run position except during updates.
WebProNews is an iEntry Publication