The Cybersecurity and Infrastructure Security Agency (CISA) on July 30 said it observed a significant increase in unspecified cyber threat actors targeting programmable logic controllers (PLCs) in the water and wastewater systems (WWS) sector.CISAs notice came on the heels of Minnesota IT Services (MNIT) reporting that there was a coordinated cyberattack targeting operational technology (OT) at more than 30 Minnesota community water systems on July 26 and July 27. The attacks in Minnesota reportedly locked out operators, caused disruption at the plants, and prompted boil-water notices, but water delivery to residents operated normally. These two pieces of news came roughly one week after seven U.S. agencies released an advisory warning that Iran-linked threat actors were observed attacking critical infrastructure.However, it’s important to note that neither CISA’s announcement yesterday nor the release earlier this week from MNIT specifically mentioned Iran.On the attacks on PLCs targeted at water systems, David Sequino, co-founder and CEO of OmniTrust, explained that exposed PLCs in water utilities are an operational failure caused by treating OT systems like IT networks.Sequino said controllers govern chemical feeds and pumps manage physical processes, not internet traffic, so telling operators to simply apply software patches or enable multi-factor authentication (MFA) ignores physical realities, where mid-stream controller reboots risk immediate service disruption.“Connecting physical controllers directly to public networks via static passwords and soft perimeters allows adversaries to bypass controls effortlessly,” said Sequino. “Without device identity anchored at the silicon level, the rest of your security stack is open to attack threatening our water supply.”
Sequino said securing these critical systems requires immediate action: operators must disconnect all human-machine interfaces (HMIs), SCADA interfaces, and PLCs from the public internet, routing remote access through isolated DMZs with strict network segmentation. Teams must also replace default credentials with hardware-backed identity, ensuring commands and firmware updates are cryptographically signed and verified by a hardware root of trust before execution. Sequino also said utilities must maintain a cryptographic bill of materials (CBOMs) to audit software components and enforce real-time machine authentication to verify every interaction across the network.Harry Thomas, co-founder and CTO at Frenos, added that CISA's recommendations are technically sound: but it can take days or weeks to discover every exposed asset, rebuild remote access, rotate credentials, validate backups, and review every controller.“Many water utilities do not have that time or the staff to execute everything simultaneously,” said Thomas. “The Minnesota attacks show that the defensive window may be measured in hours.”
Louis Eichenbaum, Federal CTO at ColorTokens, said many of these OT systems were never designed with cybersecurity in mind. They were built for reliability and availability, not to withstand modern nation-state cyber threats. Eichenbaum said unfortunately, many remain internet-facing, poorly segmented, and inadequately monitored.“That’s exactly why the cybersecurity conversation must move beyond prevention alone,” said Eichenbaum. “We are never going to patch fast enough or prevent every intrusion. The focus now must be on resilience, assuming an adversary may gain access and ensuring they cannot move laterally or manipulate critical operations at scale.”Eichenbaum said granular microsegmentation and zero-trust principles are essential in OT environments because they help contain breaches, restrict unauthorized communications, and reduce the blast radius when a compromise occurs.“The goal is not simply to stop every attack, but to ensure that a localized intrusion does not become a catastrophic operational event,” said Eichenbaum.Matan Shavit, GM North America at Hadrian, said while many organizations are intentionally avoiding direct references to Iran to prevent fear-based messaging, it’s undeniable that current geopolitical tensions have increased pressure from nation-state actors targeting critical infrastructure — particularly at the state and local level.“Water and wastewater systems have remained a primary focus, a trend we’ve seen accelerate since the war in Ukraine,” said Shavit. “The challenge is that many legacy OT systems rely on proprietary protocols, making it difficult to gain visibility into and secure them.”Seemant Sehgal, founder and CEOat BreachLock, added that 30 water systems compromised in such a short window points to a shared attack path, most likely internet-exposed PLCs or consumer-grade remote access tools sitting on control networks that were never designed to be reachable from the public internet. Sehgal said attackers seem to have found one common vulnerability and exploited it broadly.“What makes this harder than a typical vulnerability response is that some of the flaws in older PLCs are architecturally baked into how the controller authenticates or communicates and are not patchable in the traditional sense,” said Sehgal. “Because the vendor cannot fix the device, the fix requires network isolation and unfortunately shifts responsibility onto operators who often do not have dedicated OT security staff."Sehgal said the near-term work is straightforward: disconnect PLCs from the internet, move remote access behind a VPN or gateway, and treat engineering software as a privileged access path that should never get exposed.“CISA has been saying this for three years, and Minnesota is the reminder that the timeline for acting on it is shorter than most utilities providers — especially those with limited resources — planned for," said Sehgal.
Sequino said securing these critical systems requires immediate action: operators must disconnect all human-machine interfaces (HMIs), SCADA interfaces, and PLCs from the public internet, routing remote access through isolated DMZs with strict network segmentation. Teams must also replace default credentials with hardware-backed identity, ensuring commands and firmware updates are cryptographically signed and verified by a hardware root of trust before execution. Sequino also said utilities must maintain a cryptographic bill of materials (CBOMs) to audit software components and enforce real-time machine authentication to verify every interaction across the network.Harry Thomas, co-founder and CTO at Frenos, added that CISA's recommendations are technically sound: but it can take days or weeks to discover every exposed asset, rebuild remote access, rotate credentials, validate backups, and review every controller.“Many water utilities do not have that time or the staff to execute everything simultaneously,” said Thomas. “The Minnesota attacks show that the defensive window may be measured in hours.”
Louis Eichenbaum, Federal CTO at ColorTokens, said many of these OT systems were never designed with cybersecurity in mind. They were built for reliability and availability, not to withstand modern nation-state cyber threats. Eichenbaum said unfortunately, many remain internet-facing, poorly segmented, and inadequately monitored.“That’s exactly why the cybersecurity conversation must move beyond prevention alone,” said Eichenbaum. “We are never going to patch fast enough or prevent every intrusion. The focus now must be on resilience, assuming an adversary may gain access and ensuring they cannot move laterally or manipulate critical operations at scale.”Eichenbaum said granular microsegmentation and zero-trust principles are essential in OT environments because they help contain breaches, restrict unauthorized communications, and reduce the blast radius when a compromise occurs.“The goal is not simply to stop every attack, but to ensure that a localized intrusion does not become a catastrophic operational event,” said Eichenbaum.Matan Shavit, GM North America at Hadrian, said while many organizations are intentionally avoiding direct references to Iran to prevent fear-based messaging, it’s undeniable that current geopolitical tensions have increased pressure from nation-state actors targeting critical infrastructure — particularly at the state and local level.“Water and wastewater systems have remained a primary focus, a trend we’ve seen accelerate since the war in Ukraine,” said Shavit. “The challenge is that many legacy OT systems rely on proprietary protocols, making it difficult to gain visibility into and secure them.”Seemant Sehgal, founder and CEOat BreachLock, added that 30 water systems compromised in such a short window points to a shared attack path, most likely internet-exposed PLCs or consumer-grade remote access tools sitting on control networks that were never designed to be reachable from the public internet. Sehgal said attackers seem to have found one common vulnerability and exploited it broadly.“What makes this harder than a typical vulnerability response is that some of the flaws in older PLCs are architecturally baked into how the controller authenticates or communicates and are not patchable in the traditional sense,” said Sehgal. “Because the vendor cannot fix the device, the fix requires network isolation and unfortunately shifts responsibility onto operators who often do not have dedicated OT security staff."Sehgal said the near-term work is straightforward: disconnect PLCs from the internet, move remote access behind a VPN or gateway, and treat engineering software as a privileged access path that should never get exposed.“CISA has been saying this for three years, and Minnesota is the reminder that the timeline for acting on it is shorter than most utilities providers — especially those with limited resources — planned for," said Sehgal.
