2026-07-29 · view entry permalink →
Coordinated two-day cyberattack disrupts operational technology at 30+ Minnesota water and wastewater utilities; no authority has attributed it
The confirmed facts are narrow and worth stating precisely. Minnesota's technology bureau announced on 2026-07-28 that more than 30 communities had their water and wastewater utilities disrupted by a coordinated cyberattack on 26 and 27 July (StateScoop, 2026-07-28), a two-day event rather than a single-utility incident (Cybersecurity Dive, 2026-07-28). Where individual utilities described impact, it fell on field equipment rather than treatment processes: Plymouth stated the attack was limited to equipment connected via cellular communications at two water towers and multiple lift stations, and disconnected that equipment from the network to stop the attack and avoid retargeting during reconfiguration; Braham's water plant went offline, and the city later stated the outage was the result of a malicious cyberattack of computerised operating systems by unknown actors (StateScoop, 2026-07-28). Braham did ask residents to minimise water use while its tower held a limited quantity, and a later notice reported the plant back online (StateScoop, 2026-07-28), a real if temporary consumption instruction. Separately, authorities in South St. Paul said they identified a cyberattack on Monday that impacted certain automated controls, and after implementing contingency procedures confirmed no major impact to drinking and wastewater treatment operations (Cybersecurity Dive, 2026-07-28). Multiple utilities stated water remained safe and no treatment-quality impact has been reported. Minnesota IT Services coordinated a response alongside the FBI, CISA and the EPA, with its chief information security officer describing a whole-of-government response that helped prevent more serious impacts (StateScoop, 2026-07-28).
What is not established matters as much. No authority has named an actor. The Center for Internet Security's senior director of threat intelligence stated the Minnesota attacks have not yet been attributed to any particular party and that it is unclear whether the programmable logic controllers CISA had warned about were involved, and separately noted that of the nation-state attacks on US water facilities in recent years, none has documented major downstream health impacts (StateScoop, 2026-07-28). The FBI confirmed only that it is aware and in contact with victims (Cybersecurity Dive, 2026-07-28). The reason Iran appears in coverage of this event is timing: the attack landed days after federal officials warned of state-linked groups targeting a wider set of industrial devices (Cybersecurity Dive, 2026-07-28), a juxtaposition, not a finding. Treating it as attribution would be reading the calendar as evidence.
The transferable content sits in that separate advisory, and it is why this belongs in front of European water and energy operators despite the victims being American. AA26-097A documents actors using leased third-party infrastructure and the vendors' own engineering software (Rockwell Studio 5000 Logix Designer, Schneider EcoStruxure Control Expert, Siemens TIA Portal) to reach misconfigured, internet-facing controllers and pull down device project files, then re-upload files with modified or deleted logic (CISA and partners, 2026-07-22). At one victim the FBI observed a malicious project file downloaded to a PLC that retained ladder logic for downstream function but added logic overriding the instruction sets responsible for maintaining safe operating parameters, and the changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators (CISA and partners, 2026-07-22). CISA is explicit that this represents no new vulnerability in the named products; it is opportunistic targeting of misconfiguration. The affected controller families are the same Rockwell, Schneider and Siemens lines that run European water, wastewater and district-energy plants, and in one instance access came through Dropbear SSH on a victim's modem, which is precisely the class of device Plymouth found affected.
Triage: engineering software connecting to a PLC and writing a project file is exactly what commissioning and maintenance look like, so the activity class is not the signal. The discriminators the advisory's own mechanics supply are provenance and timing: a project-file write originating from outside the engineering network or from leased hosting rather than an engineering workstation; a controller left in program or remote mode outside a change window rather than in RUN; and a logic change with no corresponding maintenance record. On the network side, protocol functions that modify programs or change controller mode are the ones to surface; connection attempts to controller-associated ports are ubiquitous background noise, whereas a mode change or program write is a discrete, auditable act.
Analysis indicated the project file retained ladder logic for downstream function but added logic that overrode specific instruction sets responsible for maintaining safe operating parameters in the victim's environment.
the changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies.
The two-day attack comes days after federal officials warned of state-linked threat groups targeting a wider set of industrial devices.
Since 27 July 2026, Water and Wastewater Sector (WWS) utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations.
After remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality.
At least one organization reported modified PLC project files after noticing ladder logic discrepancies across several sites.
Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses. This activity has resulted in boil water notices and sustained manual operations.
Censys ARC identified 4,117 Internet-exposed hosts that fingerprint as Siemens SIMATIC S7-1200. Exposure concentrates heavily in southern and central Europe: Greece, Spain, Italy, and Austria together account for 86.0% of the total, each dominated by that country's leading mobile carrier rather than fixed-line or hosting providers.
After the devices are accessed remotely, the actors change the passwords and remove the ability of officials to monitor and control the devices.
caused reduced water pressure in parts of the county
the CCWA issued a precautionary boil water advisory as a safety measure
federal agencies have declined to publicly attribute the attacks
Querying the Shodan search engine on August 3, 2026 returns 4,407 devices exposing port 44818.
Although we cannot confirm these particular assets were compromised in this campaign, they had some interesting characteristics
19 of the 22 hosts (86%) were on the same mobile carrier network, connected via cellular routers
Exposing EtherNet/IP to the internet creates an unauthenticated path that, depending on device configuration, can allow attackers to obtain information about exposed assets or even write configurations on them.
We're seeing things like [programmable logic controllers] that are open and accessible on the internet with either no password set or default password set
For us, we're not doing anything with attribution right now
The coordinated attack on Minnesota water utilities is now the visible part of a wider campaign, and three federal bodies have put names and mechanics to what was previously an unattributed disruption with an unclear vector.
The FBI and EPA issued a joint Public Service Announcement on 2026-07-30 stating that "since 27 July 2026, Water and Wastewater Sector (WWS) utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations" (FBI and EPA, 2026-07-30). The same announcement names the targeted hardware as Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series controllers, while cautioning that "while the FBI has only observed this behavior with the referenced Rockwell PLCs, similar considerations should also be made with other branded PLCs" (FBI and EPA, 2026-07-30). The prior entry recorded the vector as an open question; the announcement closes it: "after remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality" (FBI and EPA, 2026-07-30). No CVE is involved; the access is unauthenticated exposure plus credential control, not a software flaw.
Two details go beyond the disruption itself. First, integrity: "at least one organization reported modified PLC project files after noticing ladder logic discrepancies across several sites" (FBI and EPA, 2026-07-30), meaning at least one operator's control logic, not just its access, was touched. Second, a shared-supplier multiplier: the FBI notes that "across several victims, similarities in network setup provided by third parties may provide MCA the opportunity to multiply successes when vulnerable network and hardware setups exist across customers" (FBI and EPA, 2026-07-30). CISA's parallel alert adds the consequence at sector scale, stating the activity "has resulted in boil water notices and sustained manual operations", and singles out cellular modems installed by operators, vendors or system integrators as a common blind spot because those connections may be undocumented and excluded from routine attack-surface scans (CISA, 2026-07-30). On the physical side, the FBI records that reported operational effects "have included loss of pressure and flooding", and that "pressure loss in water systems could potentially allow untreated ground water to seep into pipes" (FBI and EPA, 2026-07-30).
The European relevance is now quantified rather than assumed. A Censys internet scan dated 2026-07-30 found 4,148 exposed Rockwell/Allen-Bradley EtherNet/IP hosts, 71.0% of them in the United States, with combined cellular carriers accounting for 59.0% of that total, but also 4,117 hosts fingerprinting as Siemens SIMATIC S7-1200, where "exposure concentrates heavily in southern and central Europe: Greece, Spain, Italy, and Austria together account for 86.0% of the total, each dominated by that country's leading mobile carrier rather than fixed-line or hosting providers" (Censys Research, 2026-07-30). That carrier concentration is the same cellular-modem exposure class CISA flags as the routinely-unscanned blind spot, sitting on a different vendor's controllers in EU member states. Censys also counts 2,072 hosts fingerprinting as Schneider Electric hardware but states explicitly that this query "has no PLC-model or protocol filter" and "should not be read as Schneider Electric PLC exposure specifically" (Censys Research, 2026-07-30). The whole scan is framed as "an exposure characterization only: it does not confirm that any specific host is a victim of the activity CISA describes" (Censys Research, 2026-07-30).
Attribution is not merely open; the investigating bodies have declined to offer one. SecurityWeek, relaying the Associated Press, reports that the FBI "has not publicly identified a culprit and a spokesperson declined to say Thursday who the bureau thought might be responsible", and that "Minnesota IT Services said state officials had yet to identify who was behind the attacks" (SecurityWeek / AP, 2026-07-31). Neither the FBI/EPA announcement nor the CISA alert names an actor. The Iran framing in circulation has two separate origins, neither of which is an attribution of this activity: a prior multi-agency advisory warning that Iranian actors target the water and wastewater sector generally, the advisory tracked as AA26-097A, which this pipeline covered on 2026-07-24 and which the Censys report cited here names in its own subtitle (Censys Research, 2026-07-30), and an outside expert quoted by the same AP report, a former FBI cyber deputy assistant director now in the private sector, advising defenders to "treat it like it's Iran until proven otherwise" (SecurityWeek / AP, 2026-07-31). BleepingComputer's account of the CISA alert likewise names no actor (BleepingComputer, 2026-07-31). This entry carries no attribution and registers no actor entity.
Triage: an engineer legitimately changes a controller's IP address and sets a password during commissioning or a modem swap, so the events themselves are not the signal. The discriminators are provenance and sequence: the change arrives from outside the engineering-workstation address range or over the cellular path rather than the engineering VLAN, it lands outside a change window with no corresponding work order, and the password set is one operations cannot subsequently authenticate with, a lockout rather than a rotation. A project-file or ladder-logic checksum that moves without a matching download record from a known engineering host is the higher-confidence version of the same test, and the FBI's account of discrepancies noticed "across several sites" suggests comparing logic across a fleet rather than device by device.
Two things changed in the week since the FBI and EPA confirmed water and wastewater utilities in at least seven US states had reported programmable-logic-controller lockouts. The count has grown; water utilities in at least twelve states have now reported cyberattacks on their operational technology, with South Dakota and Georgia announcing incidents and several facilities in Michigan among those remediating, a figure originating with ABC News and relayed by The Record (The Record, 2026-08-05); SecurityWeek reports the same expansion and names Georgia's confirmation as following a pump-station disruption (SecurityWeek, 2026-08-05).
More useful than the count is the second change: a named utility has publicly confirmed a distribution-side consequence as its own. Clayton County Water Authority believes unauthorised cyber activity may have affected its systems in late July, and the incident caused reduced water pressure in parts of the county; the authority issued a precautionary boil-water advisory as a safety measure, and service was restored within hours once testing determined the water was safe (CBS News Atlanta, 2026-08-04). Consequences of that class were not new to the wave; the FBI has said some affected water systems experienced pressure loss and flooding as a result of the activity (CBS News Atlanta, 2026-08-04), and the original entry already carried CISA's statement that it had produced boil-water notices and sustained manual operations. What changes is attribution: those effects were previously federal aggregate reporting, and this is a single identified operator describing what happened on its own network, which is a materially different evidentiary object for anyone arguing an exposure case internally.
The mechanism is unchanged and remains the reason this belongs in a European brief. The FBI's description is that after the devices are accessed remotely, the actors change the passwords and remove the ability of officials to monitor and control the devices (The Record, 2026-08-05). There is no vulnerability in the chain, so there is nothing to patch: the entry condition is reachability plus control of a credential, which is exactly the condition the Censys scan cited in the original entry quantified for Europe, thousands of internet-exposed controllers concentrated in a handful of EU countries and reached predominantly through mobile-carrier connectivity rather than corporate address space. Attribution remains open: federal agencies have declined to publicly attribute the attacks, and no authority has tied the Clayton County incident to any actor (The Record, 2026-08-05).
The water-sector controller-lockout campaign has been tracked here through its growth to at least twelve US states and the FBI's naming of the targeted controller families. What was missing was a measurement of the exposed estate. Forescout has now published one (Forescout, 2026-08-05).
"Querying the Shodan search engine on August 3, 2026 returns 4,407 devices exposing port 44818", the EtherNet/IP engineering protocol used by the Rockwell Automation and Allen-Bradley families the joint federal advisory named. "The vast majority (65%) are located in the U.S., followed by Canada (12%) and Spain (3%)." Forescout also notes the exposed population has fallen substantially from its 2020 peak, so the trend is downward even as the absolute number stays material.
The finding worth carrying into a European estate is not the headline count but what Forescout found inside it. Of the devices located in cities the campaign targeted, "Although we cannot confirm these particular assets were compromised in this campaign, they had some interesting characteristics", and the first of those is that "19 of the 22 hosts (86%) were on the same mobile carrier network, connected via cellular routers." That is a connectivity path, not an IT-network path: controllers reachable through a mobile carrier do not appear in a scan of an organisation's own address space, do not sit behind its perimeter, and are frequently owned operationally by an integrator rather than by the utility. Separately, and confusingly sharing the same ratio, "Approximately 86% (19 of 22) hosts observed in the affected cities were susceptible to this CVE based on firmware versions", referring to CVE-2017-16740, which Forescout names but does not describe further. These are two different observations about the same 22 devices and should not be read as one.
Forescout is careful about what that CVE means here, and the care is worth preserving: "Exploitation would require Modbus TCP to be enabled, which was not confirmed", and "There is no confirmation of any CVE exploited in this campaign". The vulnerability is a patch-currency signal on devices that were already exposed and already targeted; the point being that controllers left on the public internet in attacked cities were also running eight-year-old firmware. The exposure itself needs no vulnerability at all: "Exposing EtherNet/IP to the internet creates an unauthenticated path that, depending on device configuration, can allow attackers to obtain information about exposed assets or even write configurations on them."
CISA's acting director, interviewed on the sidelines of Black Hat, described what the agency keeps finding: "We're seeing things like [programmable logic controllers] that are open and accessible on the internet with either no password set or default password set" (Nextgov/FCW, 2026-08-06). Asked about attribution he was equally direct ("For us, we're not doing anything with attribution right now") with the agency's focus on assisting affected operators instead.
Builds on: 2026-07-24/cyberav3ngers-plc-aa26-097a-schneider-siemens-expansion