CISA Warns of Increased Cyber Attacks on Exposed Wastewater PLCs

On July 30, 2026, CISA issued an alert about a rise in cyber threats targeting programmable logic controllers (PLCs) in the water/wastewater sector. The agency urged critical infrastructure operators to disconnect publicly exposed PLCs from the internet immediately. Attackers have been modifying passwords to lock out operators and changing IP addresses to disconnect PLCs. The alert highlights vulnerabilities in PLCs due to their increased connectivity to the internet, often through VPNs and gateways. Rockwell Automation has responded with a security advisory for affected controllers, emphasizing the need for enhanced security measures. The situation reflects a broader issue in operational technology (OT) security, where legacy systems struggle to adapt to modern connectivity demands. Organizations are urged to reassess their security practices to protect against these evolving threats.

Key Points: • CISA issued a warning on July 30 about cyber threats to wastewater PLCs. • Attackers have locked out operators by modifying passwords and changing IP addresses. • Rockwell Automation released a security advisory to help secure affected controllers.