FBI warns of cyberattacks on US water systems as utilities in seven states report incidents

In a statement, the FBI said it has observed malicious activity targeting internet-connected industrial control devices, particularly Rockwell programmable logic controllers (PLCs). However, the agency cautioned that similar risks may exist for other brands of PLCs as well.

“While the FBI has only observed this behavior with the referenced Rockwell PLCs, similar considerations should also be made with other branded PLCs,” the agency said.

According to the FBI, cyber actors gained remote access to internet-facing devices and altered IP addresses and passwords, causing a loss of monitoring and control capabilities.

“To reduce the risk of compromise, the FBI and EPA recommend removing PLCs from direct internet exposure via secure gateways and firewalls, setting up strong, unique passwords, and using access control lists (ACLs) to allow only authorised communication between expected control system devices,” the statement said.

The FBI said reported operational impacts included pressure loss and flooding. The agency warned that pressure disruptions in water systems could potentially allow untreated groundwater to enter pipelines, creating risks for water safety.

The extent of damage varied depending on the configuration of the affected PLCs, including whether they were used for monitoring or controlling equipment, the type of device involved, the functions they supported, and whether utilities could switch to manual operations.

The FBI and the US Environmental Protection Agency (EPA) are working with affected organisations and providing guidance to critical infrastructure operators to strengthen cybersecurity protections.

The warning comes days after Minnesota IT Services (MNIT) activated the state’s cybersecurity incident response capabilities following a coordinated cyberattack targeting operational technology at more than 30 community water systems across Minnesota on July 26 and 27.

MNIT said it is working with federal, state, local, Tribal and private-sector partners to investigate the attack, assist affected communities and enhance the security of Minnesota’s critical infrastructure.

The agency is sharing threat intelligence, providing cybersecurity guidance and supporting affected water utilities in containing, investigating and recovering from the incident.

MNIT is coordinating with several agencies, including the Minnesota Department of Public Safety, the Bureau of Criminal Apprehension’s Minnesota Fusion Center, the Minnesota Department of Health, the Minnesota Pollution Control Agency, the Cybersecurity and Infrastructure Security Agency (CISA), the EPA, the FBI and local water utilities.

The investigation remains ongoing as authorities continue to assess the scope of the cyberattack and its impact on critical water infrastructure.