The FBI and U.S. Environmental Protection Agency (EPA) have issued a public service announcement warning critical infrastructure owners and operators about cyberattacks targeting operational technology (OT) devices.
The attacks have specifically targeted Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers (PLCs), although operators should consider similar risks to other PLC brands.
Since July 27, 2026, water and wastewater utilities in at least seven states have reported incidents to the FBI. Some incidents disrupted water operations. After gaining remote access to internet-facing devices, malicious cyber actors changed IP addresses and passwords, causing utilities to lose monitoring and control capabilities.
The FBI and EPA recommend that utilities take immediate steps to reduce their risk, including removing PLCs from direct internet exposure, using secure gateways and firewalls, creating strong and unique passwords, and restricting communications to authorized control-system devices.
Read the full FBI and EPA public service announcement and recommended protective measures.
Cybersecurity preparation must also include a clear communications plan. For practical guidance, read the CASA article “Cyberattack: Communication Planning Is Essential for Water and Wastewater Agencies as Threats Increase,” republished by CWEA.
My Profile
