CISA Warns of Rising Attacks on Water System PLCs

The U.S. Cybersecurity and Infrastructure Security Agency is warning of a significant increase in attacks targeting programmable logic controllers (PLCs) that water and wastewater treatment facilities have left exposed to the internet, BleepingComputer reports.

PLCs are the embedded controllers that drive physical process operations — pump cycles, chemical dosing, pressure regulation, valve sequencing. In many municipal water systems, they were installed on isolated serial networks before IP connectivity was an expectation. Network modernization projects added that connectivity incrementally; in a significant number of deployments, it terminates directly on the public internet, unprotected.

That’s the attack surface CISA is flagging. Internet-exposed ICS equipment in the water sector is consistently discoverable via tools like Shodan, routinely running firmware that predates modern security expectations, and operated by organizations with security staffing and budgets that rarely match the criticality of what they’re running.

What’s at risk

A compromised PLC can disrupt or manipulate a physical process. Operational disruptions are the more common outcome — pumps halted, SCADA setpoints overwritten, alarms suppressed. The possibility of manipulating treatment chemistry is less common but not theoretical: the 2021 incident in Oldsmar, Florida, where an attacker briefly raised the sodium hydroxide level in the water supply through a remote desktop session, is the clearest public illustration of what this access model enables.

The attacks CISA is describing don’t require sophisticated capabilities. Default vendor credentials and internet-reachable management interfaces are sufficient entry points.

Immediate steps

CISA’s standing guidance for water and wastewater operators is actionable and specific:

• Remove PLCs from direct internet exposure. Where remote access is operationally required, route it through a VPN with multi-factor authentication — not a direct connection to the device port.
• Change all default credentials. Vendor default usernames and passwords are publicly documented; treat them as compromised on installation.
• Segment OT from IT networks. A flat routing domain between the plant floor and the corporate network is not an acceptable architecture. A firewall at minimum, with deny-by-default rules for OT-bound traffic.
• Disable unused protocols. Modbus, DNP3, and proprietary management services enabled by default should be off if they aren’t in active use.

The single highest-leverage action for any water system operator right now: audit whether any PLC or HMI in your environment is directly reachable from the public internet without a VPN in front of it. If it is, that is the fix — not a roadmap item.