A controller plugged into a cellular modem does not feel like an internet-facing system. Often enough, it is one.
In July 2026, CISA observed malicious activity targeting more than 100 internet-exposed systems in the Water and Wastewater Systems sector, commonly involving PLCs connected directly to cellular modems. (SecurityWeek)
Many reported incidents involved smaller utilities. The activity publicly documented by CISA focused on exposed or poorly protected OT, default credentials, configuration weaknesses, and known vulnerabilities rather than a single new zero-day.
What Happened?
Reporting indicates incidents across at least a dozen states, including Minnesota, Michigan, Georgia, South Dakota, New Jersey, and Alabama. CISA has not published a complete state-by-state list. (SecurityWeek)
Most reported incidents did not cause lasting disruption to drinking-water service, although some utilities lost remote-control capability, issued boil-water notices, or temporarily moved to manual operation. (GovDelivery)
Separate federal reporting on the wider PLC-targeting campaign documented manipulation of PLC logic, shutdown functions, alarms, and HMI/SCADA data.
Federal investigators and outside researchers have examined possible links to Iran-affiliated actors, but no definitive public attribution has been issued for all of the July incidents. (Minnesota.gov)
What Is an Internet-Exposed OT System?
Operational technology runs physical processes: pumps, valves, chemical dosing, pressure and flow. A programmable logic controller (PLC) executes the logic. A human-machine interface (HMI) is the screen an operator watches.
Security professionals have highlighted that much of this OT was designed for closed environments rather than direct internet exposure.
Exposure usually arrives through convenience: a cellular modem, a forwarded port, a vendor support link, or an HMI published for remote checks.
How Do Attackers Find Them?
Scanning. Internet-wide scanners index industrial protocols and device banners continuously.
Default or missing authentication. Many control devices ship with default credentials, and some deployments expose interfaces with none at all.
Direct process interaction. If a controller is exposed with weak or missing access controls, an attacker may be able to interact directly with process functions. Depending on the device and configuration, that can include reading or changing registers, logic, or operating parameters.
AI-assisted exploitation. NSA, CISA, FBI, DOE, and EPA warned in August 2026 that actors were using AI-generated exploitation scripts for reconnaissance and capability development against exposed or poorly protected Siemens S7 PLCs. (NSA)
Why Does It Matter Beyond Water?
This is not a water sector problem. The same pattern appears in building management, energy, manufacturing, and logistics: a control interface someone needed to reach remotely, still reachable long after the reason expired.
Two things separate it from an IT breach. The outcome is physical: a compromised database leaks data, while a compromised controller changes what equipment does. And the monitoring you trust may itself be manipulated. If the HMI is the only view of the process, whoever controls it decides what operators see.
Common Mistakes
- Assuming obscurity protects. Exposed devices are indexed by scanners within hours, not months.
- Treating cellular connections as private. A cellular connection can still expose OT to remote access, especially when the modem is internet-reachable or configured with public-facing services. Not every cellular connection uses a public IP.
- Leaving vendor remote access enabled. Support links installed once tend to stay on.
- Excluding OT from security testing scope. Untested is not the same as unreachable.
How to Reduce the Risk
CISA's exposure reduction guidance:
- Inventory everything internet-accessible, including cellular-connected devices, and confirm by external scanning
- Remove control systems from direct internet exposure
- Route remote access through a VPN or secure gateway
- Change default credentials. Require strong authentication for remote-access gateways and use MFA where the technology supports it. PLCs themselves may not support MFA. (GovDelivery)
- Allowlist remote access to known engineering systems where practical. CISA explicitly recommends this for exposed PLC access. (GovDelivery)
- Apply updates, monitor for anomalies, and reassess as the network changes
What Should Security Testing Cover?
Ask your testers to establish:
- What OT is reachable from the internet, cellular links included
- Whether any exposed interface accepts default credentials or none
- What an attacker reaching the IT network can touch in OT
- Whether an unauthorised change to logic or setpoints raises an alert
How OraSec Can Help
OraSec provides OT and SCADA penetration testing built around safety, alongside external penetration testing that maps what your organisation exposes to the internet.
Conclusion
More than 100 water-sector systems were targeted because their equipment was reachable.
The question is not whether your organisation runs OT, but whether anyone has checked what of it is reachable and who is allowed to talk to it.
FAQs
Why are smaller utilities often involved? Remote sites rely on cellular links, and small operators rarely have dedicated OT staff or an asset inventory.
Does this only affect the water sector? No. Any organisation running remotely accessible control systems has the same exposure.
Can PLCs use MFA? Often not. Put remote access behind a gateway that supports it, and allowlist who can reach it.
What is the fastest improvement to make? Scan your own external footprint for control interfaces, then put remote access behind a gateway with authentication.
