The Federal Bureau of Investigation (FBI) and Environmental Protection Agency (EPA) are issuing this Public Service Announcement (PSA) to warn critical infrastructure asset owners and operators that malicious cyber actors (MCAs) are conducting cyber attacks targeting Operational Technology (OT) devices, including Rockwell Automation/Allen-Bradley Programmable Logic Controllers (PLCs), specifically MicroLogix 1100 and 1400 series. Since 27 July 2026, Water and Wastewater Sector (WWS) utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations. While the FBI has only observed this behavior with the referenced Rockwell PLCs, similar considerations should also be made with other branded PLCs.
After remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality. To reduce the risk of compromise, the FBI and EPA recommend removing PLCs from direct internet exposure via secure gateway and firewalls, setting up strong, unique passwords, and utilizing an access control list (ACL) to allow only authorized communication between expected control system devices.
If I was in a power position, I could theoretically channel this water into my own private reservoirs and locations like private land, bunkers, etc to weather a disruption, and blame Iran and it would be really hard to validate.
I mean if I was in a power position I would have also disrupted those in positions who would be validating me, made journalism much harder and have algorithms with LLM-enhanced astroturf accounts running to label any questioning of the official narrative as conspiratorial or tin-foil hat.
I would probably be on sites like this downvoting people who said things like this. Yes. That's how I would do it. edit: Oh I might even consider channeling that water to my data center friends!
I think this landscape is littered with simulated systems as honeypot. Once you have it a normal adversary would stop searching, besides regular checks that the gun still works.
They always point to a state actor to skirt liability for their own shitty IT work. Then the dim evil journalists swallow it whole, later regurgitating it for their eager little baby bird subscribers.
If there were actual penalties for rawdogging a PLC (or any other control system) on the internet, shit like this wouldn’t happen.
People use 1000x more water than they need to drink.
If a water supply chain attack happened, we would just distribute bottled water for drinking, and people would go without washing for a few days whilst the issue was sorted.
Bottled water production is already big enough that delivering a bottle a day per person in new York is within the scale of the current production and retail networks scope.
It wouldn't cause the mass casualties an enemy might assume.
Why are water systems still on the internet? They should be completely cut off. If necessary, remote access must be from dedicated devices only, only to a mirrored view, and never for remote control.
>state and local officials throughout the country were on high alert for potential problems in vulnerable computers that are commonly used to monitor and adjust water quality, including chemical-treatment levels and water pressure.
You don't need a full bidirectional internet connection for remote monitoring, and data diodes are a relatively cheap way to monitor them in complete safety.
Completely stopping ingress of control (using above mentioned data diodes) is relatively easy, and should be legislated into being the norm.
19 comments
[ 0.25 ms ] story [ 34.7 ms ] threadWhat a coward and a traitor to the American people.
After remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality. To reduce the risk of compromise, the FBI and EPA recommend removing PLCs from direct internet exposure via secure gateway and firewalls, setting up strong, unique passwords, and utilizing an access control list (ACL) to allow only authorized communication between expected control system devices.
https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-...
I mean if I was in a power position I would have also disrupted those in positions who would be validating me, made journalism much harder and have algorithms with LLM-enhanced astroturf accounts running to label any questioning of the official narrative as conspiratorial or tin-foil hat.
I would probably be on sites like this downvoting people who said things like this. Yes. That's how I would do it. edit: Oh I might even consider channeling that water to my data center friends!
Struggling for a source.
Guy had the energy of that one Simcity 2000 character who bugs out if you cut back on funding that you'll regret it. Early twenty aughts IIRC?
If there were actual penalties for rawdogging a PLC (or any other control system) on the internet, shit like this wouldn’t happen.
If a water supply chain attack happened, we would just distribute bottled water for drinking, and people would go without washing for a few days whilst the issue was sorted.
Bottled water production is already big enough that delivering a bottle a day per person in new York is within the scale of the current production and retail networks scope.
It wouldn't cause the mass casualties an enemy might assume.
You don't need a full bidirectional internet connection for remote monitoring, and data diodes are a relatively cheap way to monitor them in complete safety.
Completely stopping ingress of control (using above mentioned data diodes) is relatively easy, and should be legislated into being the norm.
Coordinated cyberattack disrupts water utilities in 30 Minnesota communities
https://statescoop.com/coordinated-cyberattack-disrupts-wate...
https://news.ycombinator.com/item?id=49091021
[ok]
29 Jul 2026 07:47:11 UTC
Cyberattack targeted 30 Minnesota water systems
https://mn.gov/mnit/media/blog/?id=38-761869
https://news.ycombinator.com/item?id=49094533
[ok]
30 Jul 2026 17:08:40 UTC
U.S. Sees Iran as Likely Behind Cyberattack on Minnesota Water Systems
https://www.nytimes.com/2026/07/30/us/politics/minnesota-wat...
https://news.ycombinator.com/item?id=49112788
[ok]
30 Jul 2026 23:12:21 UTC
A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran
https://www.wired.com/story/a-leaked-memo-ties-cyberattacks-...
https://news.ycombinator.com/item?id=49117018
[ok]
31 Jul 2026 13:35:38 UTC
US investigating if Iran was behind cyberattack on water systems in seven states
https://www.cbsnews.com/news/us-investigating-iran-cyberatta...
https://news.ycombinator.com/item?id=49122974
[ok]
31 Jul 2026 18:17:17 UTC
Iranian hackers likely behind Minnesota municipal water cyberattack
https://www.axios.com/local/twin-cities/2026/07/30/report-ir...
https://news.ycombinator.com/item?id=49126761
[ok]
31 Jul 2026 23:55:10 UTC
Cyberattack on water systems in multiple states has US officials on edge
https://www.cnn.com/2026/07/31/politics/sweeping-cyberattack...
https://news.ycombinator.com/item?id=49129814
[ok]
28 Jul 2026 22:47:42 UTC | Coordinated cyberattack disrupts water utilities in 30 Minnesota communities | https://news.ycombinator.com/item?id=49091021
29 Jul 2026 07:47:11 UTC | Cyberattack targeted 30 Minnesota water systems | https://news.ycombinator.com/item?id=49094533
30 Jul 2026 17:08:40 UTC | U.S. Sees Iran as Likely Behind Cyberattack on Minnesota Water Systems | https://news.ycombinator.com/item?id=49112788
30 Jul 2026 23:12:21 UTC | A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran | https://news.ycombinator.com/item?id=49117018
31 Jul 2026 13:35:38 UTC | US investigating if Iran was behind cyberattack on water systems in seven states | https://news.ycombinator.com/item?id=49122974
31 Jul 2026 18:17:17 UTC | Iranian hackers likely behind Minnesota municipal water cyberattack | https://news.ycombinator.com/item?id=49126761
31 Jul 2026 23:55:10 UTC | Cyberattack on water systems in multiple states has US officials on edge | https://news.ycombinator.com/item?id=49129814