On July 30, 2026, CISA warned water systems across the United States of an increase in threats to water and wastewater infrastructure, stating that “these threat actors are targeting water entities of all sizes.”

The warning follows the coordinated attacks that disrupted more than 30 Minnesota water utilities on July 26–27, which took a treatment plant offline in Braham, pushed Maple Plain to declare a local state of emergency, and forced multiple systems to manual operation.

The phrase “of all sizes” is the operative part. It is a direct correction to the assumption that has governed water sector risk management for two decades — that a utility serving 1,700 people is too small to be worth attacking.

The Exposure, Counted

Censys measured 5,219 internet-exposed industrial protocol hosts globally. 3,891 of them are in the United States — 74.6% of the world’s total.

The United States has roughly 50,000 community water systems. The overwhelming majority serve fewer than 10,000 people. Most have no dedicated IT staff, let alone OT security staff. Many are run by a handful of certified operators whose expertise is water chemistry and pump maintenance, backed by an outside integrator who visits when something breaks.

That structure is why the exposure number is so lopsided toward the US. It is not that American utilities are more negligent. It is that the American water sector is more fragmented than any comparable country’s — thousands of independent municipal authorities, each procuring its own SCADA, each connecting its own remote sites over whatever cellular plan the integrator recommended, with no central authority able to mandate anything.

Advisory AA26-097A Keeps Growing

CISA advisory AA26-097A, first published April 7, 2026, documented Iranian-affiliated actors exploiting internet-exposed Rockwell Automation PLCs across water, government, and energy.

The July 22 update — issued four days before Minnesota — expanded it materially:

  • Manufacturer scope widened to include Schneider Electric (BMX P34 / Modicon M340) and Siemens (S7-1200) alongside Rockwell. This is no longer a single-vendor problem.
  • Project file exfiltration via vendor engineering software was documented. The actors are stealing control logic, which is reconnaissance for precision manipulation rather than crude disruption.
  • Detection guidance for manipulated Add-On Instructions was added — modified logic blocks that can disable safety interlocks while operator displays continue to read normal.

That third item is the one that should worry engineers most. Disruption is loud and recoverable; Braham was back in two hours. Silently rewritten safety logic is neither.

The central vulnerability, CVE-2021-22681, remains unpatchable. It is a CVSS 9.8 authentication bypass rooted in a cryptographic key shared between Rockwell’s engineering software and its controllers. Rockwell cannot rotate that key without breaking every deployed system. Five years after disclosure, the only remediation is architectural.

Why the Federal Response Is Structurally Weak

Warnings are what CISA can issue. Requirements are what it cannot.

The EPA attempted to fold cybersecurity assessment into sanitary survey requirements for public water systems in March 2023. Multiple state attorneys general sued, and the EPA withdrew the rule in October 2023. The Water Risk and Resilience Organization proposals that followed have not produced enforceable standards. There is, today, no mandatory federal cybersecurity requirement for US drinking water systems — in contrast to electricity, where NERC CIP has been binding and audited for over a decade.

Funding is the parallel failure. The Water Infrastructure Act grant programme that supported small-utility cyber assessments has never been resourced at anything close to the scale of 50,000 systems. A town of 1,700 people is not going to fund an OT security programme out of water rates.

So the sector operates on voluntary guidance, WaterISAC advisories, and the assumption that someone will read them. The Minnesota weekend is what that produces.

The Baseline That Actually Works

For any utility reading this: the controls that would have blunted Minnesota are cheap, and none of them require a security team.

  • Take PLCs off the public internet. Every one of the 3,891 exposed US hosts belongs to someone who believed a cellular APN was private. Verify, do not assume.
  • Set physical mode switches to RUN. A controller in RUN will not accept a logic download regardless of authentication. This defeats CVE-2021-22681 outright and costs a site visit.
  • Audit cellular modems. Inventory every one, confirm the APN is genuinely private, and remove any public-addressable device.
  • Segment IT from OT. A flat network turns a phished billing-clerk credential into a pump.
  • Keep verified offline backups of PLC logic, and test a restore. If Add-On Instructions are tampered with, a known-good baseline is what tells you.
  • Preserve manual operation, and drill it. Braham recovered in two hours because staff could run the plant by hand. Modernisation programmes routinely retire that capability. Do not.
  • Deploy the AA26-097A indicators and hunt for unexplained project file access.

CISA’s warning says threat actors are targeting entities of all sizes. The corollary is that defence is now required at all sizes, from organisations that were never funded, staffed, or regulated to provide it.

Sources