Rockwell Automation MicroLogix

The coordinated attack on Minnesota water utilities is now the visible part of a wider campaign, and three federal bodies have put names and mechanics to what was previously an unattributed disruption with an unclear vector.

The FBI and EPA issued a joint Public Service Announcement on 2026-07-30 stating that "since 27 July 2026, Water and Wastewater Sector (WWS) utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations" (FBI and EPA, 2026-07-30). The same announcement names the targeted hardware as Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series controllers, while cautioning that "while the FBI has only observed this behavior with the referenced Rockwell PLCs, similar considerations should also be made with other branded PLCs" (FBI and EPA, 2026-07-30). The prior entry recorded the vector as an open question; the announcement closes it: "after remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality" (FBI and EPA, 2026-07-30). No CVE is involved; the access is unauthenticated exposure plus credential control, not a software flaw.

Two details go beyond the disruption itself. First, integrity: "at least one organization reported modified PLC project files after noticing ladder logic discrepancies across several sites" (FBI and EPA, 2026-07-30), meaning at least one operator's control logic, not just its access, was touched. Second, a shared-supplier multiplier: the FBI notes that "across several victims, similarities in network setup provided by third parties may provide MCA the opportunity to multiply successes when vulnerable network and hardware setups exist across customers" (FBI and EPA, 2026-07-30). CISA's parallel alert adds the consequence at sector scale, stating the activity "has resulted in boil water notices and sustained manual operations", and singles out cellular modems installed by operators, vendors or system integrators as a common blind spot because those connections may be undocumented and excluded from routine attack-surface scans (CISA, 2026-07-30). On the physical side, the FBI records that reported operational effects "have included loss of pressure and flooding", and that "pressure loss in water systems could potentially allow untreated ground water to seep into pipes" (FBI and EPA, 2026-07-30).

The European relevance is now quantified rather than assumed. A Censys internet scan dated 2026-07-30 found 4,148 exposed Rockwell/Allen-Bradley EtherNet/IP hosts, 71.0% of them in the United States, with combined cellular carriers accounting for 59.0% of that total, but also 4,117 hosts fingerprinting as Siemens SIMATIC S7-1200, where "exposure concentrates heavily in southern and central Europe: Greece, Spain, Italy, and Austria together account for 86.0% of the total, each dominated by that country's leading mobile carrier rather than fixed-line or hosting providers" (Censys Research, 2026-07-30). That carrier concentration is the same cellular-modem exposure class CISA flags as the routinely-unscanned blind spot, sitting on a different vendor's controllers in EU member states. Censys also counts 2,072 hosts fingerprinting as Schneider Electric hardware but states explicitly that this query "has no PLC-model or protocol filter" and "should not be read as Schneider Electric PLC exposure specifically" (Censys Research, 2026-07-30). The whole scan is framed as "an exposure characterization only: it does not confirm that any specific host is a victim of the activity CISA describes" (Censys Research, 2026-07-30).

Attribution is not merely open; the investigating bodies have declined to offer one. SecurityWeek, relaying the Associated Press, reports that the FBI "has not publicly identified a culprit and a spokesperson declined to say Thursday who the bureau thought might be responsible", and that "Minnesota IT Services said state officials had yet to identify who was behind the attacks" (SecurityWeek / AP, 2026-07-31). Neither the FBI/EPA announcement nor the CISA alert names an actor. The Iran framing in circulation has two separate origins, neither of which is an attribution of this activity: a prior multi-agency advisory warning that Iranian actors target the water and wastewater sector generally, the advisory tracked as AA26-097A, which this pipeline covered on 2026-07-24 and which the Censys report cited here names in its own subtitle (Censys Research, 2026-07-30), and an outside expert quoted by the same AP report, a former FBI cyber deputy assistant director now in the private sector, advising defenders to "treat it like it's Iran until proven otherwise" (SecurityWeek / AP, 2026-07-31). BleepingComputer's account of the CISA alert likewise names no actor (BleepingComputer, 2026-07-31). This entry carries no attribution and registers no actor entity.

Triage: an engineer legitimately changes a controller's IP address and sets a password during commissioning or a modem swap, so the events themselves are not the signal. The discriminators are provenance and sequence: the change arrives from outside the engineering-workstation address range or over the cellular path rather than the engineering VLAN, it lands outside a change window with no corresponding work order, and the password set is one operations cannot subsequently authenticate with, a lockout rather than a rotation. A project-file or ladder-logic checksum that moves without a matching download record from a known engineering host is the higher-confidence version of the same test, and the FBI's account of discrepancies noticed "across several sites" suggests comparing logic across a fleet rather than device by device.

Two things changed in the week since the FBI and EPA confirmed water and wastewater utilities in at least seven US states had reported programmable-logic-controller lockouts. The count has grown; water utilities in at least twelve states have now reported cyberattacks on their operational technology, with South Dakota and Georgia announcing incidents and several facilities in Michigan among those remediating, a figure originating with ABC News and relayed by The Record (The Record, 2026-08-05); SecurityWeek reports the same expansion and names Georgia's confirmation as following a pump-station disruption (SecurityWeek, 2026-08-05).

More useful than the count is the second change: a named utility has publicly confirmed a distribution-side consequence as its own. Clayton County Water Authority believes unauthorised cyber activity may have affected its systems in late July, and the incident caused reduced water pressure in parts of the county; the authority issued a precautionary boil-water advisory as a safety measure, and service was restored within hours once testing determined the water was safe (CBS News Atlanta, 2026-08-04). Consequences of that class were not new to the wave; the FBI has said some affected water systems experienced pressure loss and flooding as a result of the activity (CBS News Atlanta, 2026-08-04), and the original entry already carried CISA's statement that it had produced boil-water notices and sustained manual operations. What changes is attribution: those effects were previously federal aggregate reporting, and this is a single identified operator describing what happened on its own network, which is a materially different evidentiary object for anyone arguing an exposure case internally.

The mechanism is unchanged and remains the reason this belongs in a European brief. The FBI's description is that after the devices are accessed remotely, the actors change the passwords and remove the ability of officials to monitor and control the devices (The Record, 2026-08-05). There is no vulnerability in the chain, so there is nothing to patch: the entry condition is reachability plus control of a credential, which is exactly the condition the Censys scan cited in the original entry quantified for Europe, thousands of internet-exposed controllers concentrated in a handful of EU countries and reached predominantly through mobile-carrier connectivity rather than corporate address space. Attribution remains open: federal agencies have declined to publicly attribute the attacks, and no authority has tied the Clayton County incident to any actor (The Record, 2026-08-05).

The water-sector controller-lockout campaign has been tracked here through its growth to at least twelve US states and the FBI's naming of the targeted controller families. What was missing was a measurement of the exposed estate. Forescout has now published one (Forescout, 2026-08-05).

"Querying the Shodan search engine on August 3, 2026 returns 4,407 devices exposing port 44818", the EtherNet/IP engineering protocol used by the Rockwell Automation and Allen-Bradley families the joint federal advisory named. "The vast majority (65%) are located in the U.S., followed by Canada (12%) and Spain (3%)." Forescout also notes the exposed population has fallen substantially from its 2020 peak, so the trend is downward even as the absolute number stays material.

The finding worth carrying into a European estate is not the headline count but what Forescout found inside it. Of the devices located in cities the campaign targeted, "Although we cannot confirm these particular assets were compromised in this campaign, they had some interesting characteristics", and the first of those is that "19 of the 22 hosts (86%) were on the same mobile carrier network, connected via cellular routers." That is a connectivity path, not an IT-network path: controllers reachable through a mobile carrier do not appear in a scan of an organisation's own address space, do not sit behind its perimeter, and are frequently owned operationally by an integrator rather than by the utility. Separately, and confusingly sharing the same ratio, "Approximately 86% (19 of 22) hosts observed in the affected cities were susceptible to this CVE based on firmware versions", referring to CVE-2017-16740, which Forescout names but does not describe further. These are two different observations about the same 22 devices and should not be read as one.

Forescout is careful about what that CVE means here, and the care is worth preserving: "Exploitation would require Modbus TCP to be enabled, which was not confirmed", and "There is no confirmation of any CVE exploited in this campaign". The vulnerability is a patch-currency signal on devices that were already exposed and already targeted; the point being that controllers left on the public internet in attacked cities were also running eight-year-old firmware. The exposure itself needs no vulnerability at all: "Exposing EtherNet/IP to the internet creates an unauthenticated path that, depending on device configuration, can allow attackers to obtain information about exposed assets or even write configurations on them."

CISA's acting director, interviewed on the sidelines of Black Hat, described what the agency keeps finding: "We're seeing things like [programmable logic controllers] that are open and accessible on the internet with either no password set or default password set" (Nextgov/FCW, 2026-08-06). Asked about attribution he was equally direct ("For us, we're not doing anything with attribution right now") with the agency's focus on assisting affected operators instead.