US Alerts on Water System Attacks

CISA and the FBI have publicly warned of a significant escalation in attacks against OT devices in U.S. water systems. The incidents include operators being locked out of OT networks and malicious changes to passwords and monitoring and control settings.

What did CISA order water and wastewater utilities to do?

CISA issued a specific alert for water and wastewater utilities and asked them to disconnect PLCs and other control devices from the internet as soon as possible. It also told operators to review their public IP ranges to remove direct exposure of OT.

How far did the recent attacks spread?

The Wall Street Journal and El Imparcial reported that the [recent attacks on water and sewage systems](/en/news/mexico-govt-monterrey-water-hit) affected at least seven U.S. states. The impact reached equipment that controls wells, pumps, and water towers.

What did the attackers do in some cases?

In some cases, attackers changed passwords and network settings, which blocked remote control of the equipment.

Which vendors did the campaign expand toward?

Cybersecurity Dive said the campaign expanded its focus from Rockwell Automation equipment to Schneider Electric and Siemens, suggesting a broader wave of activity against OT. Multiple industrial vendors were hit across water and energy.

The U.S. response also included public calls from CISA for water and wastewater operators to remove internet access from control systems as soon as possible and adopt network segmentation practices. In that coverage, the agency also released a separate advisory on Iranian actors.

International coverage, including The Straits Times and Chinese-language media, echoed that message. The warning reached different media markets with the same emphasis on disconnecting control systems and reducing direct OT exposure.