The water sector just got it’s wake-up call. Again.

The FBI and EPA alert details active attacks on internet-facing PLCs at multiple U.S. water and wastewater utilities that exploited exposed, unpatched controllers and default/shared credentials to lock out operators, alter ladder logic, and disrupt operations (pressure loss, flooding, manual control, local emergency). The article emphasizes the systemic causes (aging devices, limited budgets, voluntary rules, reused vulnerable configurations by integrators) and prescribes immediate mitigations: remove controllers from the public internet, fix passwords, restrict device communications, lock logic, practice manual operation, maintain asset inventories, and implement continuous OT monitoring.