Cyberattacks Target Small U.S. Water Utilities via Exposed PLCs

• •Over 30 Minnesota water utilities reported cyberattacks in July 2026.
• •Attackers exploited exposed PLCs using default credentials, locking operators out.
• •Dispel's new program aims to enhance cybersecurity for small utilities.

In late July 2026, over 30 municipal water utilities in Minnesota experienced cyberattacks, where attackers exploited internet-exposed programmable logic controllers (PLCs) using default or missing credentials. The attackers altered configurations and locked operators out of their equipment, highlighting vulnerabilities in small utilities that lack dedicated cybersecurity resources. In response, Dispel launched the Community Power & Water Program to provide secure remote access solutions tailored for small water and electric utilities. This program aims to help these utilities protect themselves from similar threats without extensive infrastructure changes. The incidents align with a federal advisory from CISA warning about the risks associated with internet-exposed PLCs. As of now, the Minnesota incidents have not been formally attributed to any specific threat actor. The situation underscores the urgent need for improved cybersecurity measures in the critical infrastructure sector, particularly for smaller utilities.