Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-
Facing Programmable Logic Controllers, Causing Operational Disruptions

The Federal Bureau of Investigation (FBI) and Environmental Protection Agency (EPA) are warning water and wastewater utilities and other critical infrastructure operators of ongoing cyberattacks targeting internet-facing operational technology devices, particularly Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers. Since July 27, 2026, affected utilities in at least seven states have reported incidents in which malicious cyber actors changed device IP addresses, passwords, and configurations, causing loss of monitoring or control and, in some cases, operational disruptions including pressure loss and flooding. Organizations should immediately remove PLCs from direct internet exposure, enforce strong unique passwords, restrict communications through firewalls and access control lists, review devices and project files for unauthorized changes, and ensure personnel can safely transition to manual operations when necessary