CISA says more than 100 internet-exposed water systems were targeted in July
July 30, 2026 (July 30 and late August 2026)
On July 30, CISA warned water and wastewater operators that threat actors target utilities of all sizes, and that even mature programs should check external connections, including cellular modems installed by operators, vendors or integrators that may not be documented. In an update reported in late August, CISA said it saw malicious activity against more than 100 internet-exposed systems in the sector in July, most commonly controllers connected directly to a cellular modem. It reported no significant disruption to water service. The FBI has urged utilities to disconnect systems from the internet where possible and be ready to revert to manual controls.
Why it matters
The assumption that a very small utility is too small to target no longer holds, and nothing in the advisory describes a new technique.
What defenders can take from it
- Scan your own address space for exposed controllers and modems, and document every cellular connection.
- Replace default credentials and disconnect what does not need to be online.