U.S. cybersecurity officials say more than 100 internet-exposed systems across the water and wastewater sector were targeted in a recent wave of cyber intrusions, offering a clearer view of the scale behind the activity.
The incidents have affected providers in Michigan, Minnesota, and at least five other states, underscoring how widely connected operational technology can be exposed when systems are reachable online.
Focus on industrial control systems
CISA said the attacks have primarily centered on programmable logic controllers, or PLCs, the industrial devices that help run physical processes in water facilities and other critical infrastructure environments. The agency noted that similar equipment is also used in energy and manufacturing settings.
According to the advisory, recent activity has involved PLCs from several manufacturers, including Rockwell, Schneider Electric, and Siemens. CISA has also said some attackers appear to be using AI-assisted methods and public information to build scripts aimed at vulnerable systems.
While the intrusions have not significantly disrupted water delivery for most communities, they have caused outages and operational interruptions as response teams assess the affected systems. In some cases, officials said attackers were able to alter PLC settings tied to alarms and shutdown functions.
The affected communities are often rural or geographically isolated, where even short interruptions can have an outsized impact on local services.
The episode has added momentum to broader efforts to strengthen the resilience of critical infrastructure, especially as more industrial systems connect to the internet. The next phase of cybersecurity innovation may define how reliably essential services operate in an increasingly digital future.
