U.S. Issues Federal Advisory For Water Utilities Of All Sizes On PLC Cyber Risk
On July 30, 2026, the FBI and the U.S. Cybersecurity & Infrastructure Security Agency (CISA) advised water and wastewater utilities to remove publicly exposed programmable logic controllers (PLCs) and other operational technology from the internet as soon as possible. The advisories follow reports of cyber breaches affecting water utilities across multiple states, including about 30 confirmed breaches in Minnesota alone.
PLCs are control systems that water and electric utilities use to automate and transmit data regarding water flow, pressurization, tank levels, and chemical concentrations.
Despite a renewed focus on their vulnerabilities, cyberattacks on PLC equipment are not new. A compromised controller can allow attackers to force equipment to operate beyond safe thermal, pressure, or speed boundaries, cause unexpected shutdowns, or lock out operators and demand ransoms to restore control. Although the recent federal advisories specified certain PLC products, they emphasized that all water and wastewater utilities–regardless of size or specific PLC brands–should implement these precautions.
06-Aug-2026 | 11:57 EDT