Cyberattacks on U.S. Water Systems: What the FBI and CISA Confirmed
The July attacks exposed internet-facing industrial controls across multiple states and reinforced a broader lesson about how remote access should be designed.
On July 26 and 27, 2026, malicious cyber activity targeted technology systems at more than 30 Minnesota community water systems. In several cities, public works staff noticed the same thing at roughly the same time: equipment stopped answering.
Within days, the FBI and EPA had confirmed a broader wave affecting water and wastewater organizations in at least seven states.
The story quickly became entangled with a separate federal advisory describing an active Iranian-affiliated campaign against internet-connected operational technology. The connection is plausible and under investigation, but it has not been formally established. Keeping those two stories separate matters not only for accurate attribution, but because the technical lessons are useful regardless of who is ultimately held responsible.
What happened, and how far it spread
Minnesota IT Services activated a statewide cybersecurity response on July 28. In Plymouth, communications were disrupted at two water towers and multiple wastewater lift stations. The city disconnected affected equipment, shifted to manual procedures, and restored communications without an impact on water quality.
The affected equipment used cellular connectivity, while reporting indicated that fiber-connected sites were uninterrupted. That does not make cellular networking inherently unsafe. It illustrates a broader issue: remote field connectivity can create external paths that may not appear in a utility's conventional IT perimeter or asset inventory.
Braham, a city of about 1,700, experienced a similar problem when controls for its well and treatment plant went offline. The city relied on water already stored in its tower until crews restored operations. Manual operation became an important part of recovery across the Minnesota incidents.
Minnesota's July 30 update was also notable for what it did not say. The state had not attributed the attacks to a specific actor, and investigators had not determined that every incident was necessarily carried out by the same actor.
On July 30, the FBI and EPA issued Public Service Announcement I-073026-PSA, with CISA publishing a companion sector alert. The FBI said organizations in at least seven states had reported incidents since July 27. The targeted systems included internet-exposed Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers, or PLCs.
After obtaining remote access, attackers changed device IP addresses and set passwords, causing operators to lose visibility and, in some cases, functionality of connected equipment. The activity described in the PSA centers on configuration manipulation; the PSA does not specify an exploit used for initial access.
Changing a controller's IP address can make it disappear from the SCADA system. Alarms and telemetry stop arriving even though the physical process itself may continue. The FBI reported operational effects including pressure loss and flooding, while CISA said some incidents resulted in boil-water notices and sustained manual operations. No boil-water advisories were issued in Minessota.
The official federal baseline remains at least seven states. ABC News and CBS News later reported incidents in at least 12 states, citing sources familiar with the investigation. That distinction is worth preserving: seven is what the FBI has publicly confirmed; 12 is the wider scope reported by credible news organizations.
Why Iran is being discussed
As of August 11, no U.S. agency has publicly attributed the July water-sector incidents to Iran or any other actor.
What federal agencies have confirmed is a separate campaign. Joint Cybersecurity Advisory AA26-097A, initially published in April and updated July 22, assesses that Iranian-affiliated advanced persistent threat actors have been exploiting internet-connected operational technology across U.S. critical infrastructure since at least March 2026, including water and wastewater systems.
The advisory describes different controller families and more advanced activity than the July FBI/EPA announcement. Federal investigators observed attackers using manufacturers' engineering software to access misconfigured internet-facing controllers, exfiltrate controller project files, modify logic, and manipulate information displayed to operators through HMI and SCADA systems. In one case, modified logic interfered with shutdown and alarm behavior.
That distinction matters technically. Configuration changes can blind or lock out an operator. Changes to control logic can alter the physical process itself and may be considerably harder to detect.
There is also historical precedent for investigators examining an Iran connection. In 2023, IRGC-affiliated actors known publicly as CyberAv3ngers compromised internet-exposed Unitronics controllers across several U.S. critical-infrastructure sectors, including water, using default credentials and replacing legitimate controller logic.
Recent reporting says U.S. intelligence officials suspect Iran is behind the July attacks, but formal public attribution has not followed. The responsible formulation is therefore straightforward: investigators are examining a possible Iran connection, while federal agencies have separately confirmed an Iranian-affiliated campaign against internet-connected PLCs. Those findings should not be collapsed into one.
What made these systems vulnerable
A PLC is an industrial computer that reads sensor inputs and controls physical equipment such as pumps and valves. In a water system, a controller might start a pump when a tower level falls, open or close a valve, or control equipment at a wastewater lift station.
Because these systems interact with physical processes, losing visibility or control has consequences beyond an ordinary IT outage.
The challenge is also structural. GAO says the United States has more than 153,000 drinking-water systems and approximately 16,500 wastewater systems. Many are small and operate with limited cybersecurity resources. A small municipality is unlikely to employ a dedicated OT security engineer; cybersecurity responsibilities may instead fall to general IT or public works staff, along with outside contractors and systems integrators.
EPA's Office of Inspector General identified critical or high-risk cybersecurity vulnerabilities at 97 large drinking-water systems serving approximately 26.6 million people in a 2024 assessment. EPA has separately reported basic weaknesses such as unchanged default passwords and shared credentials during inspections.
Industrial control assets can remain in service for decades. They are designed primarily for reliable operation, not continuous software replacement, and are often commissioned by integrators who may also provide remote connectivity for maintenance and support.
That connectivity can be completely legitimate. The risk is not the existence of remote access. It is remote access that nobody can confidently account for or control.
What the FBI and CISA recommend now
The federal guidance can be reduced to four practical priorities.
1. Find and remove direct exposure. Identify what actually answers from outside, including PLCs, cellular-connected field equipment, modems, and remote paths installed by integrators or vendors. CISA specifically warns that some cellular connections may not appear in routine attack-surface scans. Where possible, disconnect controllers from the public internet.
2. Broker and authenticate the access that remains. The FBI and CISA point organizations toward architectures where operational technology is not directly exposed to external networks and remote access is mediated through a controlled gateway or jump host. Depending on the environment, federal guidance identifies options including private APNs, Zero Trust Network Access, site-to-site VPNs, and other isolated connectivity architectures. MFA should be used for external access where possible. ZTNA is one option among several, not a blanket recommendation for every OT environment.
3. Segment and protect the control environment. Restrict controller communications so only expected systems can reach them. Separate IT and OT where appropriate, disable unnecessary services, maintain known-good controller configurations, and keep clean offline backups. Where logic may have been changed, compare running projects against a known-good state rather than assuming restored connectivity means the system is trustworthy.
4. Prepare to operate manually. Several affected utilities relied on manual procedures while automation was unavailable. The FBI specifically recommends practicing manual operation and testing continuity plans, fail-safes, backups, and standby systems.
The federal notices also explicitly state that the agencies do not endorse any commercial entity, product, or service. Their recommendations should be understood as architectural and operational guidance, not vendor endorsements.
The remote-access lesson, and where SecureRDP fits
Nothing in the public record suggests Remote Desktop Protocol played a role in these incidents. These were attacks against operational technology, and TruGrid SecureRDP is not an OT security product.
The broader architectural question does carry over, however: which management interfaces are reachable from the internet, do they need to be, and can remote access be authenticated and mediated before it reaches the protected environment?
For Windows environments, those questions apply to internet-facing RDP, Remote Desktop gateways, and VPN infrastructure. A directly published TCP/3389 listener is a well-understood liability. An RD Gateway behind HTTPS with MFA remains vulnerable because of the direct exposure; as is a maintained VPN concentrator. Essentially, every externally reachable service still becomes part of the surface an organization must patch, monitor, authenticate, and defend.
TruGrid has made a version of this argument for years, including in its 2020 coverage of an FBI warning about ransomware attacks against K-12 schools through exposed RDP.
TruGrid SecureRDP addresses the Windows-specific remote-access problem by brokering connections to Windows desktops, servers, Microsoft RDS and RemoteApp environments, and administrative workstations in the cloud. Authentication and MFA are completed before the session reaches the network, without requiring an inbound RDP port or customer-hosted remote-access gateway to be exposed to the internet.
The lesson: reduce unnecessary internet exposure and verify access before it reaches the resource.
Where this stands
The investigation is still developing, and attribution may change. What is less likely to change is the defensive lesson.
The FBI's warning centers on internet-facing controllers, and the Minnesota incidents show why every external path into operational technology needs to be understood, including connectivity installed years ago by a vendor or integrator. In every publicly described recovery, the fallback was people.
Neither problem is solved by a product alone. One is an architecture and inventory problem. The other is a preparedness problem.
Sources and further reading
Primary and supporting sources used for the article. Key factual claims are also linked contextually in the body.
- FBI / EPA — Public Service Announcement I-073026-PSA, July 30, 2026
- CISA — Water and Wastewater Systems Sector alert on activity targeting PLCs, July 30, 2026
- CISA and partners — Joint Cybersecurity Advisory AA26-097A, updated July 22, 2026
- NCSC-UK / FBI / CISA — Secure Connectivity Principles for Operational Technology
- Minnesota IT Services — Minnesota continues response to cyber activity affecting community water systems, July 30, 2026
- City of Plymouth — Communications restored at Plymouth water facilities, July 27, 2026
- CISA and partners — AA23-335A on IRGC-affiliated CyberAv3ngers PLC activity
- U.S. State Department — Rewards for Justice: CyberAv3ngers
- GAO — Critical Infrastructure Protection: Persistent Cybersecurity Threats to Water and Wastewater
- EPA Office of Inspector General — Cybersecurity Concerns Related to Drinking Water Systems
- EPA — Enforcement Alert: Drinking Water Systems to Address Cybersecurity Vulnerabilities
- Washington Post — reporting on suspected Iranian involvement, August 10, 2026
- ABC News — reporting that incidents had been identified in at least 12 states
- CBS News — reporting on the wider multi-state incident scope
- FBI warns K-12 schools of ransomware attacks via RDP
