Posted on 08/13/2026 8:09:14 PM PDT by SeekAndFind
Cyber warfare is increasingly coming for U.S. water supplies.
Water providers in at least seven U.S. states have been targeted by cyberattacks over the past two weeks, according to multiple agencies including the FBI, the Environmental Protection Agency (EPA), and the Cybersecurity and Infrastructure Security Agency (CISA). Some officials indicated that as many as a dozen states could have been impacted.
The hackers targeted components known as programmable logic controllers, which allow utility providers to manage the flow and even chemical composition of water supplies to the homes and businesses they serve, according to the agencies. In many cases, they “modified passwords to lock out operators and disconnected the [controllers],” CISA said in a recent advisory.
There are still no indications that the cyberattacks have caused major disruption or lasting damage to water supplies—at least some of the operators were reportedly able to switch to manual operations or use backup systems. However, CISA said that they were serious enough in some cases to have “resulted in boil water notices” to affected people.
The implications of the attacks are more severe, however. Programmable logic controllers help operators regulate the flow, distribution, and even chemical composition of the water supply. There have been a few close calls: In 2021, a hacker reportedly attempted to increase chemical levels at a Florida plant before being discovered in time, and in 2024, an attack caused a tank in Texas to overflow.
While the U.S. government has yet to officially attribute the latest attacks to a particular adversary or group, several reports as well as multiple former officials that Foreign Policy spoke to indicated that they are very likely linked to Iran. “I’m incredibly confident that these attacks are Iran,” said Cynthia Kaiser, who served as deputy assistant director of the FBI’s cyber division…
(Excerpt) Read more at foreignpolicy.com ...
Why do these PLCs have Internet connections in the first place?
Not true.
This just screams out to us, doesn't it? Why do these systems need an Internet connection? If they just MUST communicate with the outside, there ARE ways of making them 100% secure. My systems do not use standard protocols. None have ever been hacked. Of course, they also "call out" and never accept an inbound connection.
Many municipal water systems operate with small teams—sometimes only a few technicians overseeing multiple stations across vast geographic areas.
To your question, why are PLCs connected to the internet? I can think of the following reasons:
24/7 Alerts: Remote connectivity allows engineers to receive instant alerts on mobile devices or home terminals if a pump fails, a chemical level drops, or pressure spikes outside normal thresholds.
Off-Hour Management: Without remote access, utilities would need round-the-clock, on-site staffing at every pump house, booster station, and treatment facility, dramatically increasing labor costs.
Diagnostic Speed: Vendors often demand remote access (via VPNs, cellular gateways, or remote desktop tools) to diagnose glitches or adjust configurations without dispatching a field technician.
Enterprise Integration: Utility business networks (IT) need operational data from plant floors (OT) for billing, inventory forecasting, and compliance dashboards.
Cloud SCADA/Telemetry: Smaller utilities increasingly use cloud-hosted SCADA platforms or IoT sensors to manage data storage and reporting, which inherently relies on internet connectivity.
In many cases, PLCs were never intended to be directly exposed to the public internet, but end up exposed due to networking mistakes.
I have had three houses in NH. All on drilled wells. The first two had heavy iron content. So, I had to filter the water. The current house had Radon at over 100K(10K is suggest limit). So, I put in a Bubble Up unit inline after the bladder tank.
The last two houses I had to replace the well pump. First one was down 220’. I had to replace the casing and the electrical wires($2500).
This house I had to replace the pump about eight years ago.
Casing and wires were still good($1400).
We had the water tested because there have been some issues with PFAS and old gasoline stations in the general area leaking into the water table. Our water is fine, except for the radon. I just filer it through the fridge.
I forgot to mention the second house well pump was UNDER the screened in porch for my kitchen. Meaning the well head was not exposed when we bought the house(vintage 1972). The porch had a brick floor. Under the brick was a couple inches of sand and then a concrete patio. Installed by one of the previous owners.
We found the location by taking off the connection inside the basement wall and sticking an electrical fish tape into the pipe(14’). That was about 3’ inside the corner of the porch on the end of the house.
The guys from the well company had to bring in a cutoff saw to cut through the concrete. Down 7’ in the ground was the well head in a crypt they built in 1972.
They said it could have been WORSE. I said HOW? They said well at least it is not under the in ground swimming pool. Which was about 20’ away.
He went on to say that yes they had once had a well installed under the shallow end of the pool. They ended up drilling a new well. They also told me about someone who had built a family room addition over the well head. With a crawlspace underneath. They had to cut through the hardwood floor of the room to be able to pull the pump up and replace it.
My issue happened during the Second Gulf War. My screened in porch off the kitchen was full of demo for awhile.
We used to refer to the porch as Fallujah(Iraq). Due to the piles of concrete, bricks and sand.
I live in the REAL Midwest....not the one up near the Great Lakes that some have talked about. Anyway we have had the city here occasionally call out issues with the water, but nothing real bad. My wife (now passed) wouldn’t drink city water, so we got a Culligan cooler & used their water. No problems have occurred that I know of. The expense is there , but it’s bearable. Supposedly, their water is run through reverse osmosis if I understand right.
ZERO water brand is distilled bottled water. I buy that when I am traveling for my CPAP machine. Around here I buy distilled water by the gallon. For the CPAP.
I can do all of the above without exposure. (I design PLCs)
I wonder what it means to be ‘incredibly confident’...
RE: I can do all of the above without exposure. (I design PLCs)
I’m curious, how would you design PLCs to meet all the requirements ( 24x7 alerts, Enterprise Integration, etc ) without internet connection?
Oh, I use Internet connections, outbound only. If it has to be controlled from afar I do not use any of the standard protocols, and use the tickle/callback method. My systems connect outbound only with predesignated addresses.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.