Back Controldesign

Jeremy Pollard explains why exposed wastewater PLCs are getting hacked

Controldesign • August 6, 2026

The threat is real. In case you hadn’t heard by now, the Cybersecurity & Infrastructure Security Agency (CISA) issued an alert on July 30 regarding a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the water/wastewater sector.

While the U.S. government has not at this point made a public attribution of the activity, CISA has urged all critical infrastructure owners, operators and integrators to remove publicly exposed PLCs and other OT devices from the internet ASAP. Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing IP addresses, according to the CISA alert .

Control Design’s longest standing columnist, automation industry veteran Jeremy Pollard, spoke with me the vulnerabilities of PLCs; the evolution of their connectivity to the Internet; the use of virtual private networks (VPNs) and gateways; and what machine builders can learn from this to keep industrial equipment secure.

Rockwell Automation has addressed the alert with a published security advisory including guidance on restoring access to MicroLogix 1400 and MicroLogix 1100 controllers when the password is unknown. Its corporate communications spokesperson indicated: "Rockwell Automation takes the security of its products and solutions seriously and has been working with customers, partners and government agencies regarding reports of unauthorized cyber activity and disruptions at some utilities. Rockwell Automation has provided customers with guidance and published security advisories that include recommendations for strengthening the security of operational technology environments."

Mike Bacidore is chief editor of Control Design and has been an integral part of the Endeavor Business Media editorial team since 2007. Previously, he was editorial director at Hughes Communications and a portfolio manager of the human resources and labor law areas at Wolters Kluwer. Bacidore holds a BA from the University of Illinois and an MBA from Lake Forest Graduate School of Management. He is an award-winning columnist, earning multiple regional and national awards from the American Society of Business Publication Editors. He may be reached at [email protected]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Coordinated Cyberattack Disrupts Water Utilities in Minnesota A coordinated cyberattack affected water utilities in over 30 Minnesota communities on July 26 and 27, 2026. Key cities impacted include Plymouth, South St. Paul, Braham, and Maple Plain. The attack targeted computerized operating systems, causing temporary outages but no compromise to water quality. Officials reported that the attacks were executed by unknown actors, with speculation pointing towards Iranian hacking groups. Minnesota's IT Services activated its cybersecurity response capabilities, collaborating with federal agencies like CISA and the FBI. While the immediate threat was contained, investigations into the attack's origin are ongoing. Residents were assured that drinking water remained safe throughout the incident. 198 sources 77

Extracted Entities

Platforms (2)

MicroLogix 1100 MicroLogix 1400