# CISA Warns Water Utilities of Increased Cyber Threats Targeting PLCs

*Published July 31, 2026*
*Source: [https://www.securityweek.com/cisa-urges-water-sector-to-protect-ot-after-coordinated-attacks-on-plcs/](https://www.securityweek.com/cisa-urges-water-sector-to-protect-ot-after-coordinated-attacks-on-plcs/)*

## Executive Summary

CISA has issued an alert urging water and wastewater utilities to secure their operational technology following cyberattacks on PLCs in Minnesota. This is part of an increasing trend of threats targeting critical infrastructure, prompting immediate action to protect these systems.

## Article

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert urging operators of water and wastewater systems to secure their operational technology (OT) against cyber threats. This follows a series of coordinated cyberattacks that disrupted automated controls at numerous water utilities in Minnesota. The alert highlights a growing trend of threat actors targeting programmable logic controllers (PLCs) within the sector. CISA's advisory emphasizes the need for immediate action to remove publicly exposed PLCs and OT from the internet.

According to CISA, attackers have been modifying passwords to lock out legitimate operators and changing the IP addresses of PLCs to cause disconnections. These actions have led to the issuance of boil water notices and forced manual operations in several cases, similar to the recent incidents reported by Minnesota utilities. The alert also points out that water entities of all sizes are at risk, even those with robust cybersecurity measures in place.

The recent attacks on over 30 community water systems in Minnesota have raised significant concerns. Although contingency procedures were activated and operations remained mostly functional, the incidents underscore the vulnerabilities within the sector. While investigations continue, there has been no formal attribution of the attacks. However, the timing coincides with a US government warning about Iran-linked threats targeting industrial control systems.

CISA recommends immediate steps for water utilities to protect their systems. These include disconnecting PLCs from the internet and routing remote access through VPNs or gateway devices, enabling password protection and changing default passwords, and allowlisting IP addresses to restrict remote access to critical OT assets. The agency also advises maintaining a clean backup of PLC images to ensure recovery in case of a lockout. Utilities are encouraged to review indicators of compromise for signs of malicious activity on their networks.