Critical Infrastructure Security , Government security , OT Security Over 100 US water utilities had cyberattacks in July, says CISA August 26, 2026 Share By Steve Zurier (Adobe Stock) The Cybersecurity and Infrastructure Security Agency (CISA) reported that more than 100 internet-exposed water systems were attacked in July. Previous reports said the attacks were on water systems in 12 states . While no more information on where the attacks took place was released, the agency said the attackers typically targeted programmable logic controllers (PLCs) connected directly to a cellular modem in the guidance CISA issued . CISA said all organizations in the water and other critical infrastructure sectors should route all necessary remote access through a secure gateway, firewall, VPN, or other centrally managed access solution, as opposed to connecting directly to a PLC, human-machine interface (HMI), or remote terminal unit (RTU). The guidance from CISA comes on the heels of reports Aug. 26 that water-sector supplier Micro-Comm had nearly 850,000 files leaked by attackers. While Iran-linked actors are suspected of the vast majority of the July attacks on water systems, Micro-Comm and the FBI said responsibility for the most recent incident was claimed by Barracuda, a relatively new ransomware group that claims it’s motivated by profit and not government sponsored. “The Micro-Comm attack demonstrates that protecting the water utility itself is only half the problem,” said Kevin Surace, chief executive officer of TokenCore. “Attackers can go after the companies that manufacture, configure, maintain, and remotely support the technology inside hundreds of utilities.” Surace added that the most important recommendation from CISA is to get OT off the public internet when it does not absolutely need to be there. Surace said CISA was right to call for reducing exposure, using secure gateways, patching systems, and continuously monitoring traffic. Denis Calderone, chief technology officer at Suzu Labs, said recent events show how the industrial control systems threat landscape has grown much more sophisticated: In 2023, the CyberAv3ngers were simply changing default passwords on Unitronics PLCs and putting political messages on HMI screens. But by July of this year, CISA confirmed that actors were exfiltrating PLC project files using the vendors' own engineering software and modifying add-on instructions to disable safety shutdowns while leaving the operator displays looking normal. Just last week, five federal agencies warned that attackers are using AI to generate working exploitation scripts against Siemens S7 controllers, calling it an evolution that “dramatically reduces the technical expertise and time required.” “That’s the trajectory, and the Micro-Comm breach feeds into that narrative,” said Calderone. “What makes the Micro-Comm breach so dangerous is the stolen proprietary data. The five-agency advisory said threat actors are collecting public information about PLC vulnerabilities and using AI to generate scripts that act on it. Now, imagine what becomes possible with a non-public disclosure? There are product diagrams, system architecture documents, customer-specific configurations, details about how SCADAview CSX communicates with the controllers it monitors.” Calderone said attackers can now hand that documentation to an unguardrailed AI model and the output is not generic Modbus reads on port 502: it's targeted tooling built against a specific vendor's implementation, informed by the manufacturer's own engineering materials. Experts warn of a systemic risk Matt Hartman, chief strategy officer at Merlin Group, added that the fact CISA reports more than 100 internet-exposed water systems were targeted in a single month underscores that we’re now looking at a systemic risk, not a series of isolated incidents. “Water utilities often rely on operational technology that was never designed to be directly exposed to the internet, while attackers are also looking for weaknesses across the vendors that support these environments,” said Hartman. Hartman said security team should prioritize what CISA has emphasized: identify internet-exposed assets, remove unnecessary exposure, change default credentials, patch supported systems, secure required remote access with controls like MFA, and continuously monitor for anomalous activity. Danny Jenkins chief executive officer at ThreatLocker, added that the attacks CISA disclosed show that adversaries view these utilities as attractive targets because of a combination of poor defenses and the potential impact of damaging the water supply. “Utilities should disconnect operational technology like PLCs from the public internet as quickly as possible, which means transitioning to other methods like private lines or satellite communications,” said Jenkins. Steve Zurier Steve Zurier has been a freelance writer and editor for SC Media since 2012. Today, Zurier writes daily news stories and edits SC Media’s Perspectives columns. A long-time member of the tech press, Zurier lives in Columbia, MD. On off-hours, Steve moonlights as a jazz and Klezmer bassist around the Baltimore/DC area. Related Risk Assessments/Management Why mission risk should drive cyber operations strategies Joyce Rancani August 25, 2026 Here's how a risk-based approach can foster cyber resilience. Government security US lawmakers question CISA workforce cuts amid rising cyber threats SC Staff August 25, 2026 The lawmakers' letter to the GAO seeks an in-depth review of CISA's workforce changes over the past five years, including its size, composition, and reliance on contractors. Critical Infrastructure Security Senate bill aims to prepare U.S. electric grid for quantum computing threats SC Staff August 24, 2026 The Quantum-GUARD Act directs the Federal Energy Regulatory Commission (FERC) to consider quantum computing threats when reviewing reliability standards for electricity owners and operators. Related Events Webcast Public sector security: Achieving resilience in the AI age Tue Sep 8 Cybercast From code to cloud: Stopping attacks in the software supply chain On-Demand Event Virtual Conference Securing the Backbone: Strategies to Counter Cyber Threats to Critical Infrastructure in the Public Sector On-Demand Event Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe You can skip this ad in 5 seconds