Coordinated Attack on Rockwell MicroLogix PLCs Disrupts Water Systems Across 7+ States

overview

A coordinated cyberattack targeted operational technology (OT) at water utilities across at least 7 states, with confirmed disruptions at 30+ Minnesota community water systems on July 26–27, 2026. The FBI and EPA report that attackers specifically targeted internet-facing Rockwell Automation MicroLogix 1100/1400 programmable logic controllers (PLCs), modifying controller configuration by changing IP addresses and passwords.

The attack resulted in loss of operational control, pressure loss in water distribution systems, and flooding at affected facilities. Braham, Minnesota's water plant went offline; Plymouth, South St. Paul, and Maple Plain experienced communications failures, automated control disruptions, or both. Minnesota IT Services (MNIT) coordinated a statewide response with CISA, EPA, FBI, and affected utilities.

Tenable noted timing and operational patterns consistent with the broader CyberAv3ngers threat ecosystem, though official attribution has not been confirmed. A concurrent CISA advisory (dated July 22, 2026) warned of Iranian-affiliated actors targeting internet-facing PLCs from Rockwell Automation, Schneider Electric, Siemens, and potentially other manufacturers.

attack flow

1. Attackers gain initial access to internet-facing Rockwell MicroLogix 1100/1400 PLCs at water utilities (access method not publicly disclosed by authorities).
   
   
2. Attackers modify PLC project files and configuration, changing IP addresses and authentication credentials to prevent legitimate operators from regaining control.
   
   
3. Loss of operational control triggers downstream failures: water pressure drops, automated shutdowns fail, and alarm logic is disabled or bypassed.
   
   
4. Water distribution system pressure loss cascades to secondary failures: equipment damage, flooding in pump stations, and service disruptions across interconnected utility networks.
   
   
5. Operators resort to manual controls to mitigate damage and restore service, while emergency response teams coordinate incident response and system restoration.
   
   
6. Attackers exfiltrate project files, HMI data, and SCADA system information for further exploitation or intelligence gathering.

scope of attack

Confirmed Affected Water Systems:

• Minnesota: 30+ community water systems targeted; 4 systems publicly disclosed operational impacts (Braham, Plymouth, South St. Paul, Maple Plain)
• Multi-State: FBI and EPA confirm at least 7 states experienced incidents involving Rockwell MicroLogix 1100/1400 PLCs
• Infrastructure Affected: Water treatment plants, wastewater lift stations, distribution networks, and cellular communications systems at water tower locations

Confirmed Operational Impacts:

• Braham: Water treatment plant went offline; residents asked to minimize water use during remediation
• Plymouth: Cellular communications lost at two water towers and multiple wastewater lift stations; manual operations continued
• South St. Paul and Maple Plain: Automated utility controls compromised; manual operations restored; Maple Plain declared local state of emergency

technical details

Rockwell Automation MicroLogix 1100 and 1400 are compact PLCs used in water utility automation for remote monitoring and control of pumps, valves, and treatment processes. Both models support internet connectivity for remote access and management.

Attack Mechanism:

• Attackers accessed internet-facing PLCs via remote management ports (method not disclosed by authorities; likely exploitation of default credentials, unpatched vulnerabilities, or weak authentication)
• Modified PLC project files: changed IP addresses, authentication passwords, and operational parameters
• Disabled or corrupted safety logic: alarm functions, shutdown procedures, and pressure relief mechanisms became inoperable
• Manipulated SCADA/HMI displays: operators may have received false or suppressed pressure, flow, and status readings

threat attribution

U.S. agencies have not officially attributed the Minnesota attacks. However, Tenable noted that the timing and operational pattern align with the broader CyberAv3ngers threat ecosystem. On July 22, 2026 (four days before the Minnesota attacks), CISA and the Iranian Ministry of Interior released a coordinated advisory warning of Iranian-affiliated actors targeting internet-facing PLCs from Rockwell Automation, Schneider Electric, Siemens, and potentially other manufacturers. The advisory observed attackers exfiltrating and modifying project files, manipulating SCADA/HMI displays, and disabling shutdown and alarm logic, consistent with the operational impact seen in the Minnesota and multi-state water utility attacks.

Investigators noted attackers may be testing capabilities or performing reconnaissance for future, more destructive campaigns targeting critical infrastructure.

potential impact

• Water service disruption: Loss of pressure, treatment capability, or distribution control can deprive communities of safe drinking water and firefighting capability.
• Equipment damage: Uncontrolled pressure changes damage pumps, pipes, and treatment equipment; flooding causes secondary infrastructure damage.
• Public health risk: Contamination risk if automated treatment or disinfection processes are disabled; boil-water advisories may be necessary.
• Operational disruption: Manual control of critical infrastructure requires 24/7 staffing and increases risk of human error.
• Persistent access: Attackers retain knowledge of system configuration, credentials, and network topology for follow-up attacks or espionage.
• Cascading failures: Interconnected utility networks may experience cascading outages affecting neighboring water systems and wastewater treatment.

indicators of compromise

• Internet-facing Rockwell MicroLogix 1100/1400 PLCs accessible via SHODAN, Censys, or similar scanning services
• Unusual login attempts or successful authentication to PLC management interfaces from unexpected IP addresses
• PLC project files modified unexpectedly or with unknown authorship dates (check firmware/project file timestamps)
• Changed PLC IP addresses, DNS settings, or default authentication credentials
• Disabled or modified alarm, shutdown, or pressure relief logic in PLC project files
• SCADA/HMI displaying conflicting or impossible sensor values (e.g., extreme pressure readings followed by sudden drop)
• Cellular modem connections lost or redirected to unexpected gateways
• Backup copies of PLC project files accessed or exfiltrated via FTP, USB, or network shares

monitoring and telemetry

• OT network monitoring: Alert on unexpected IP address changes, password resets, or firmware updates to PLCs outside maintenance windows
• PLC access logs: Monitor login attempts, especially from external IPs or non-standard management ports (not standard TCP 502 for Modbus)
• SCADA data validation: Continuously verify SCADA readings against physical sensor redundancy; alert on implausible values or rapid fluctuations
• Network segmentation: Monitor traffic crossing air-gap boundaries between IT and OT networks; alert on unexpected data flows
• PLC project integrity: Implement file integrity monitoring on PLC project files; alert on unexpected modifications
• Cellular connectivity: Monitor cellular modem connections at water tower and remote sites; alert on unexpected reconnections or IP changes
• Backup restoration validation: Test PLC backup restoration procedures regularly to ensure rapid recovery capability

recommendations

Immediate Actions (within 24 hours):

• Audit internet-facing PLCs: Identify all Rockwell MicroLogix, Schneider Electric, Siemens, and other manufacturer PLCs with public IP addresses or accessible via remote management ports. Conduct network scans using SHODAN or Censys to find exposures.
• Disable remote access: Remove or restrict internet-facing PLC management interfaces. Use VPN or site-to-site connectivity only; never expose PLC management ports directly to the internet.
• Reset credentials: Change all default and administrative passwords on PLCs. Use strong, unique passwords; do not reuse passwords across systems.
• Validate project files: Inspect PLC project files for unauthorized modifications. Check file modification timestamps, logic changes, and credential alterations. Compare against known-good backups.
• Test manual operations: Ensure backup manual control procedures are in place and staff are trained to operate critical systems without automation.

Detection and Hunting:

• Retroactive hunt: Review PLC logs and network traffic for the past 90 days for unauthorized access attempts, credential changes, or project file modifications.
• Hunt for exposed PLCs: Use SHODAN, Censys, or internal scanning to identify all internet-accessible PLC management interfaces. Prioritize immediate isolation.
• File integrity analysis: Compare current PLC project files against backups; flag any differences in logic, IP addresses, or credentials.

Incident Response Preparation:

• Develop OT incident response plan: Define roles, escalation procedures, and manual operation procedures for water treatment and distribution systems.
• Backup management: Maintain offline backups of PLC project files, configuration, and authentication data. Test backup restoration procedures quarterly.
• Interagency coordination: Establish relationships with FBI, EPA, CISA, and neighboring utilities for threat intelligence sharing and coordinated response.

Ongoing Governance:

• Network segmentation: Implement air-gapped networks for critical OT systems; restrict IT-to-OT communication to authenticated, monitored channels.
• Multi-factor authentication: Deploy MFA for all remote access to OT systems, if supported by PLC manufacturer.
• Patch management: Subscribe to Rockwell Automation, Schneider Electric, and Siemens security advisories. Apply critical patches promptly; test in non-production environments first.
• Security by design: When procuring new PLCs or automation equipment, prioritize products with secure-by-default configurations, role-based access control, and encryption support.

SUPPORTING DOCUMENTATION

• • The Hacker News — Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline
  • CISA Alert AA26-097A — Targeting of Programmable Logic Controllers by Iranian-Affiliated Actors
  • Tenable Research — Coordinated Cyberattack on Minnesota Water Utilities: What You Need to Know
  • Minnesota IT Services — Statement on Water Utility Cybersecurity Incident Response
  • Rockwell Automation — MicroLogix Processor Documentation and Security Advisories