2026 U.S. Water Utilities Attacks
2026 U.S. Water Utilities Attacks was a campaign against more than 30 municipal water and wastewater utilities in Minnesota, beginning 27 July 2026, amid a wider pattern of similar activity the FBI and EPA reported across at least seven U.S. states.[1][2] The adversary targeted internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series programmable logic controllers reachable through cellular gateways at water towers and sewer lift stations, remotely accessing them and reconfiguring their IP addresses and passwords to lock operators out of monitoring and control functions.[3][4] At least one victim organization's PLC program logic was altered, and reported operational effects included loss of water pressure and flooding, with one utility taking its treatment plant offline entirely.[4][2] The campaign has not been formally attributed; some reporting describes the broader pattern as consistent with Iranian-affiliated activity, but attribution for the Minnesota intrusions specifically remains unconfirmed.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| ICS | T0892 | Change Credential |
During the 2026 U.S. Water Utilities Attacks, the adversary remotely accessed internet-facing devices (e.g., MicroLogix 1100 and 1400 controllers, etc.) and changed passwords resulting in loss of monitoring and control for the affected utilities.[3][4][1][2] |
|
| ICS | T0813 | Denial of Control |
During the 2026 U.S. Water Utilities Attacks, the adversary denied operators the ability to control their systems by shutting down and disabling computerized water plant controls via malware over a wireless connection.[3][4][1] |
|
| ICS | T1694 | .001 | Insecure Credentials: Default Credentials |
During the 2026 U.S. Water Utilities Attacks, the adversary logged in to internet-exposed PLCs using default credentials.[3] |
| ICS | T0883 | Internet Accessible Device |
During the 2026 U.S. Water Utilities Attacks, the adversary located internet-exposed PLCs (e.g., Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs, etc.) at water and wastewater utilities, including cellular-connected water towers and sewer lift stations, and logged in to them directly.[3][4][2] |
|
| ICS | T0826 | Loss of Availability |
During the 2026 U.S. Water Utilities Attacks, the adversary temporarily shut down the well and water treatment plant, causing loss of cellular connectivity across multiple sites interrupting the service the plant provides leading operators to revert to manual operations.[3][1] During the 2026 U.S. Water Utilities Attacks, the adversary caused loss of water pressure and flooding at affected water and wastewater utilities.[2] |
|
| ICS | T0827 | Loss of Control |
During the 2026 U.S. Water Utilities Attacks, the adversary changed passwords on internet-facing MicroLogix controllers, locking out operators, and causing water and wastewater utilities to lose control of their equipment (e.g., controllers, water towers, lift stations).[3][4][1][2] |
|
| ICS | T0829 | Loss of View |
During the 2026 U.S. Water Utilities Attacks, the adversary changed passwords on internet-facing MicroLogix controllers, causing the affected utilities to lose monitoring of their equipment (e.g., water tower, lift station, etc.).[3][4][1][2] |
|
| ICS | T0836 | Modify Parameter |
During the 2026 U.S. Water Utilities Attacks, the adversary changed the IP addresses of internet-facing MicroLogix controllers, altering their network configuration settings outside normal operations.[3][4][1][2] |
|
| ICS | T0889 | Modify Program |
During the 2026 U.S. Water Utilities Attacks, the adversary altered the control logic (e.g., project files) of internet-exposed PLCs, producing ladder logic discrepancies, changing how the affected controller interacted with its process, after gaining access through default credentials.[3][4][2] |
|
References
- Michael Rothschild. (2026, August 13). Water Under Attack: A Decade of Warnings, and the Same Gaps Still Open. Retrieved October 8, 2026.
- FBI Press Office. (2026, July 30). Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions. Retrieved October 8, 2026.