CISA to Water Operators: Pull Exposed PLCs Off the Internet Now
CISA's July 30 alert tells water and wastewater operators to pull PLCs off the public internet after attackers locked Minnesota utilities out of their own controllers. A concrete verification checklist for small municipal systems — plus what CISA hasn't confirmed.
For years, federal guidance to small water utilities has amounted to a version of "read the advisory and check your indicators of compromise." CISA's July 30 alert changes the ask. It tells water and wastewater operators to physically pull programmable logic controllers off the public internet — now — because attackers aren't just probing exposed controllers anymore. They're changing the controllers' IP addresses and passwords to lock operators out of their own equipment.
The alert follows a coordinated intrusion that Minnesota IT Services says hit operational technology at more than 30 community water systems on July 26 and 27. CISA didn't attribute the Minnesota incidents to anyone, and it didn't issue an emergency directive or a compliance deadline. What it issued is narrower and more useful: a short list of things an operator can verify this week, and a blunt warning that the exposure isn't limited to small or unsophisticated shops.
The Problem: Controllers Answering to the Open Internet
A PLC is the small industrial computer that opens and closes valves, runs pumps, and doses chemicals. Plenty of community water systems put them online for remote monitoring — one operator watching a plant from a laptop at home is cheaper than staffing the plant overnight. CISA says it's now seeing a significant increase in threat actors targeting those internet-facing controllers in the water and wastewater sector, and it urged owners, operators, and integrators to remove publicly exposed PLCs and other OT from the internet as soon as possible, SecurityWeek reported.
The tactics CISA describes are crude and effective. Attackers modified passwords to lock out operators and disconnected PLCs by changing their IP addresses, which CISA says produced boil-water notices and stretches of sustained manual operation — the same pattern several Minnesota utilities reported. That's the mechanism worth internalizing: an internet-reachable controller with a default or weak password can be taken over and then made unreachable to the people who run it. This isn't data theft. It's loss of control of a physical process, and getting it back can mean rebuilding a controller from a backup you may not have.
Why the Exposure Persists
None of this is new advice, which raises the harder question: why are the controllers still online? The answer is mostly about how small utilities actually operate.
Staffing is the first reason. Many community systems serve a few thousand people and split one or two people across every IT and OT job in the plant. Direct remote access to a PLC is how a single operator covers nights and weekends without living on site. Default credentials are the second — the fact that "change default passwords" is step two of CISA's guidance tells you how often they're still in place.
The third reason is the one CISA leaned on hardest, because it defeats a utility that thinks it has already closed the door. The agency specifically called out cellular modems installed by operators, vendors, or system integrators that may not be documented or captured in routine attack surface scans. A plant can believe it has no internet-facing OT and still have a modem someone else wired in during a service call. CISA stressed that the targeting spans water entities of all sizes and that even organizations with mature programs should validate their external connections — so both "we're too small to be a target" and "we're too buttoned-up to be exposed" are wrong readings.
This pattern isn't unique to water. CISA and its partners issued a comparable warning about internet-exposed automatic tank gauges in fuel systems — cheap, internet-reachable OT with weak authentication is the recurring theme across sectors.
What CISA Says to Do Now
The alert names three immediate steps. First, disconnect the PLC from the internet and route any remote access through a VPN or gateway device rather than pointing the connection straight at the controller. Second, enable password protection and change default passwords. Third, allowlist IP addresses so remote access is permitted only from known engineering laptops or other critical OT assets.
CISA paired those with a recovery step that maps directly to the lockout tactic: after disconnecting a PLC, keep a known-clean backup of its image so a modified password can't leave you locked out for good. Operators of Rockwell Automation MicroLogix 1400 controllers are pointed to Rockwell's dedicated guidance for restoring access when the password is unknown. My read: the value here isn't novelty — every item is basic — it's verification. Each step converts cleanly into a yes-or-no question an operator can answer today, which is the format the checklist below uses.
Operator Verification Checklist
- Can any PLC or HMI be reached directly from the public internet? Test it from an off-network connection. If yes, that's the first thing to move behind a VPN or gateway.
- Have you inventoried every cellular modem on the OT network — including any a vendor or integrator installed? Undocumented modems are the exposure CISA says routine scans miss.
- Are default passwords still set on any controller? Change them and turn on password protection wherever it's off.
- Is remote access limited to an allowlist of known engineering-workstation IP addresses, or open to any source?
- Is the OT network segmented from business IT, so a phished office laptop can't route to a PLC?
- Do you have a known-clean image backup of each PLC, stored offline, so you can restore if you're locked out?
- Is logging enabled on remote-access paths and controllers, so an unauthorized IP change or password reset would show up?
Built from CISA's July 30 alert to the water and wastewater sector and CISA/EPA water-sector cybersecurity baselines. Checks, not a compliance form — each maps to a mitigation CISA named or to the exposure it described.
What's Still Unconfirmed
The attribution is not settled. State and federal agencies are investigating the Minnesota attacks, and no formal attribution has been made. Iranian groups including CyberAv3ngers and Handala fit the profile — CyberAv3ngers has a long record against small water utilities — but investigators have not tied these specific incidents to any named actor. Treat the Iran connection as context, not confirmation. Our earlier reporting covered an Iran attribution circulating through the water sector's own channels via a leaked memo; that moved through WaterISAC, the sector's non-federal information-sharing hub, and is distinct from anything CISA has publicly endorsed.
The document type matters too. This is a CISA alert — a call to action — not an emergency directive, and it carries no compliance deadline. "As soon as possible" is the standard, which means no one is coming to enforce it and operators shouldn't wait for a mandate. The named vendor controllers come from a separate track: the AA26-097A advisory, updated July 22 and co-signed by CISA, the FBI, and EPA, which listed Rockwell CompactLogix and Micro850, Schneider Electric Modicon M340, and Siemens S7-1200 controllers. CISA notes that PLCs from other makers may also be at risk, so a controller that isn't on that list isn't automatically safe.
One open question worth flagging rather than filling: it hasn't been established publicly whether the Minnesota intrusions used the same access path — exposed PLCs or unmanaged cellular modems — described in the advisory, or something else entirely. Until that's confirmed, the checklist above is the defensible response precisely because it doesn't depend on the answer.
If you run a small water or wastewater system, the highest-value hour this week is confirming whether anything in your plant answers to the open internet — controllers, HMIs, and the modems you didn't install yourself. Everything else in CISA's alert follows from that one check.
