CISA Urges Utilities to Remove Internet-Exposed PLCs After Minnesota Attacks

CISA and state investigators are responding to coordinated attacks that impacted operational technology at over 30 Minnesota water systems (with PLC-related incidents reported across at least seven states). Attackers remotely accessed internet-facing PLCs, changed passwords and IPs to lock out operators, and in some cases exfiltrated PLC project files; CISA warns of active exploitation of CVE-2021-22681 in Rockwell devices (no patch available) and recommends immediately removing PLCs from the internet, segmenting OT, changing default credentials, and auditing all remote-access paths.