Consider a rural water operator in Minnesota who’s never heard the term “attack surface.” Their programmable logic controller — the device physically managing pumps and valves — is plugged into a cellular modem, connected to the open internet, running default passwords. In July 2026, CISA confirmed that over 100 internet-exposed systems were targeted in a single month, marking the first time the federal government put a hard number on a single wave of water-sector intrusions. Former CISA acting cyber head Matt Hartman called it what it is: “a systemic vulnerability across the sector, not a run of isolated, unlucky targets.”
The attack mechanics are depressingly simple. Threat actors scanned for PLCs — devices from Rockwell/Allen-Bradley, Schneider Electric, and Siemens — exposed on industrial ports including 44818, 2222, 102, and 502, then accessed cellular modems via SSH. No firewall. No gateway between the controller and the open internet.
One exposure analysis using Censys data shows the problem isn’t contained:
- Over 4,000 Siemens SIMATIC S7-1200 hosts
- More than 4,000 Rockwell/Allen-Bradley hosts
- Roughly 2,000 Schneider Electric hosts remain reachable right now
Affected utilities span at least a dozen states, including Minnesota, Michigan, Georgia, South Dakota, and New Jersey. A late-July incident alone disrupted more than 30 community water systems in Minnesota.
When AI Writes the Exploit Code
Open-source libraries plus AI coding assistants have cut the path to compromising critical infrastructure dramatically shorter.
A joint advisory from CISA, NSA, FBI, DOE, and EPA signals a sharper escalation: adversaries are now using AI-generated exploitation scripts alongside open-source libraries — snap7 and python-snap7 — to attack Siemens S7 series PLCs via the S7comm protocol. That gives attackers read/write access to PLC memory, ladder logic, and configuration data. The dual-use AI problem that analysts debated in the abstract has arrived at the operational layer of water infrastructure.
Cynthia Kaiser, SVP at Halcyon’s Ransomware Research Center and former FBI deputy assistant director for cyber, described the Siemens S7 campaign as “a continuation of the same suite of activity we suspect is affiliated with Iran targeting PLCs.” Analysts increasingly tie the July attacks to Iranian-affiliated campaigns documented in prior CISA advisories — though CISA, NSA, FBI, DOE, and EPA have not formally attributed either campaign to any specific actor.
John Gallagher of Viakoo put it plainly: 100 systems may be 0.5 percent of U.S. water utilities, but the real threat is that these are test runs for a larger-scale attack.
CISA’s guidance is specific and actionable:
- Disconnect PLCs from the internet
- Route all remote access through a VPN or secure gateway
- Change default passwords
- Allowlist only known devices
Hartman’s framing cuts through the attribution debate — right now, “the ‘who’ matters less than understanding how the attacks are occurring and taking steps to stop them.”
