What Happened
In July, attackers targeted over 100 internet-exposed water systems across the U.S. They focused on programmable logic controllers (PLCs) connected to cellular modems, exploiting misconfigurations, default credentials, and outdated software. Operators lost access as attackers changed PLC passwords and altered device IP addresses. States affected included Minnesota, Michigan, South Dakota, Georgia, New Jersey, and Alabama.
Timeline
Pre-July: The water sector relied on operational technology designed for reliability, not internet exposure. Many PLCs were connected via cellular modems without proper security controls.
Throughout July: Attackers used platforms like Shodan, Censys, and Thingful to identify exposed systems. They exploited weak credentials and unpatched vulnerabilities to access controllers.
July 30: CISA issued an alert warning that attackers were locking out operators by changing passwords and severing access through IP address manipulation.
August: CISA published guidance revealing the scale of targeting and provided a four-step mitigation framework. Utilities of all sizes were affected, including those with mature security programs.
Which Controls Failed or Were Missing
Network Segmentation: PLCs were directly reachable from the internet through cellular modems, violating basic segmentation principles. There was no boundary protection between operational technology and external networks.
Access Control: Default credentials remained on internet-facing devices. No multifactor authentication protected remote access paths. Attackers gained entry through credentials that should have been changed during initial deployment.
Asset Management: Organizations lacked visibility into their full attack surface. Many didn't know which assets were exposed through vendor infrastructure, contractor connections, or legacy systems outside their known IP space.
Patch Management: Systems ran outdated software and devices no longer receiving security support. The gap between patch availability and deployment created exploitable windows.
Remote Access Security: Cellular modems provided direct internet connectivity without virtual private networks or other protective controls. Organizations treated operational necessity as justification for exposure without implementing compensating controls.
What the Relevant Standards Require
ANSI/ISA-62443 establishes security requirements for industrial automation and control systems. Section 3-3 specifically addresses system security requirements and levels. The standard requires:
- Zone and conduit model: Segment operational technology into security zones with controlled communication paths (conduits) between them.
- Defense in depth: Layer multiple security controls so single-point failures don't compromise the entire system.
- Secure remote access: When remote connectivity is necessary, protect it through encrypted channels and strong authentication.
NIST Cybersecurity Framework 2.0 addresses these challenges through its Protect function:
- PR.AC-5: Network integrity is protected through segmentation.
- PR.AC-7: Users and devices are authenticated before access is granted.
- PR.DS-5: Protections against data leaks are implemented.
- PR.PT-4: Communications and control networks are protected.
The framework's Identify function also requires asset management (ID.AM-1 through ID.AM-4) that extends beyond your known IP space to include vendor-managed and legacy infrastructure.
CISA's guidance translates these requirements into four operational steps: assess current internet exposure, evaluate operational necessity, mitigate risk to assets that must remain exposed, and reassess routinely. For necessary remote access, the agency specifies VPNs and multifactor authentication as baseline controls.
Lessons and Action Items for Your Team
Stop treating cellular modems as secure remote access. A cellular connection is internet exposure. If your PLCs connect directly through cellular modems, you're running the same architecture that failed in July. Map every cellular-connected device in your environment this week.
Search for your assets the way attackers do. Run your organization's name and known IP ranges through Shodan and Censys. Then search for your vendor names, contractor-managed infrastructure, and subsidiary entities. You'll likely find exposed assets you didn't know existed. One water utility discovered vendor-managed systems they'd never inventoried.
Build a decision tree for internet exposure. For each exposed asset, answer: Is remote access necessary? Can we achieve the same outcome through scheduled on-site access or a jump host within a segmented zone? If exposure is truly necessary, what compensating controls protect it? Document your answers because CISA expects you to reassess routinely.
Implement microsegmentation before the next wave. You're not going to patch fast enough. Small utilities won't suddenly gain enterprise security teams. The gap closes when you reduce the blast radius of inevitable compromises. Microsegmentation limits lateral movement from a breached PLC to your broader network.
Replace default credentials as if your water supply depends on it. If you're running default passwords on internet-facing devices, you're not securing critical infrastructure; you're operating an open invitation. Change them today, then implement a process that prevents defaults from reaching production.
For small utilities: Recognize that sustainability requires rate structure changes. Federal grants and state funding help, but they're not recurring. If your utility serves a small community, work with your rate-setting authority to build security costs into the rate structure. Point them to the 93% noncompliance rate for federal drinking water standards among small systems. Security failures eventually become safety failures.
If you lack in-house expertise, get external help now. Programs like Def Con Franklin place technical volunteers with under-resourced utilities. Managed detection and response services are expanding to the water sector. Waiting until you're locked out of your own PLCs is not a strategy.
The July attacks revealed a systemic vulnerability: operational technology designed for isolated environments now sits directly on the internet, protected by nothing more than default credentials and hope. You can't prevent every intrusion, but you can make your environment resilient enough that a single compromised PLC doesn't cascade into a loss of water service.
Start with your cellular modems. If they're connecting PLCs directly to the internet without VPNs, segmentation, or multifactor authentication, you're running the same architecture that just failed at scale.
