CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do

CISA warned that a July 2026 wave of attacks impacted over 100 internet-exposed PLCs in the U.S. water sector, with attackers remotely changing device IPs and credentials and disrupting monitoring and control functions; the agency published exposure-reduction guidance urging operators to discover internet-facing ICS devices (using tools like Shodan/Censys or CISA scanning), remove unnecessary remote access, and secure required access via centrally managed gateways, MFA, unique credentials, and active traffic monitoring. The report frames the incidents as part of a broader nation-state interest in critical infrastructure and emphasizes that basic network hygiene could have prevented many compromises.