U.S. water utility PLC attacks campaign

Beginning 26 July 2026, attackers manipulated internet-exposed PLCs at U.S. water and wastewater utilities; CISA later said it observed malicious activity against more than 100 internet-exposed water-sector systems in July.

Incident ID

CP-2026-005

Incident date

26 JUL 2026

Detection date

26 JUL 2026

Affected countries

United States

Plotted location

Minnesota, United States (Most affected state (30+ community water systems); campaign spanned 12+ states)

Threat classification

Level 4 — CRITICAL

Classification rationale

Multi-state campaign against drinking-water control systems causing boil-water notices and manual operations.

Attack type

Infrastructure Compromise

Nature

Malicious activity

Attack vector

Exploitation of internet-exposed programmable logic controllers (notably Rockwell/Allen-Bradley MicroLogix), often connected via cellular modems

Sectors

Water

Critical infrastructure

Yes

Organizations affected

30+ Minnesota community water systems, Clayton County Water Authority (Georgia), Rapid City wastewater (South Dakota), Other U.S. water utilities

Operational consequences

CISA said the activity resulted in boil-water notices and sustained manual operations, though it reported no significant disruption to water supply; utilities in at least a dozen states reported incidents.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

No official attribution recorded

SOURCE REFERENCES

1. [1] CISA warns of spike in attacks on water systems as Minnesota incidents probedThe Record · therecord.media
2. [2] CISA: Over 100 internet-exposed water systems targeted in July cyberattacksSecurityWeek · securityweek.com · 26 AUG 2026
3. [3] Cyberattacks on water systems expand to 12 states as South Dakota, Georgia announce incidentsThe Record · therecord.media

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.