FBI and EPA Warn That Hackers Are Hijacking Water Treatment Controllers in Real Time
A joint FBI/EPA advisory says attackers are breaking into water utility PLCs, locking out operators, and disrupting service across at least seven states.
On July 30, the FBI and the Environmental Protection Agency published a joint Public Service Announcement warning that malicious cyber actors are actively targeting the Programmable logic controllers running Water and Wastewater Sector (WWS) utilities across the United States. According to the FBI’s advisory, the attacks are concentrated on Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 controllers that have been left exposed to the public internet, and since July 27, utilities in at least seven states have reported incidents to the Bureau in which attackers changed the devices’ IP addresses and passwords to lock out legitimate operators, causing loss of pressure, tank overflows, and in at least one case, outright flooding.
The attack pattern is the kind that doesn’t require much sophistication to pull off, which is partly what makes it alarming. The FBI’s writeup describes attackers using factory-default credentials or otherwise brute-forcing their way into controllers, then simply reconfiguring the device so the actual utility staff can no longer reach it. Once an operator is locked out of a programmable logic controller — the small industrial computer that actually drives pumps, valves, and chemical feeders at a treatment plant — the consequences are immediate and physical, not digital: pressure drops, tanks run over, and in the worst cases water has to be manually shut off at the street while the controller is restored.
Independent analysis of the same advisory by Censys’s ARC research team gives a sense of the underlying exposure that makes these incidents possible. Censys found roughly 4,148 Rockwell/Allen-Bradley EtherNet/IP hosts, 4,117 Siemens SIMATIC S7-1200 hosts, and 2,072 Schneider Electric hosts reachable from the public internet on the day they scanned — thousands of industrial controllers that anyone, including any attacker, can simply connect to. The same writeup flags cellular modems attached to remote pumping and tank stations as a particularly common blind spot: a small utility uses a cell link to monitor a lift station in the middle of a field, never thinks of it as an internet-exposed asset, and leaves it wide open.
The downstream effects on the affected utilities are mundane in the worst way. Censys’s reporting describes affected sites falling back on sustained manual operations and, in some cases, issuing boil-water notices to customers while the controllers are sorted out — which is to say that an intrusion on a piece of industrial hardware effectively becomes a public-health and customer-service event, not just an IT one. None of the seven-state incidents reported to the FBI appear to have caused contamination, but the operational disruption alone is what the advisory is trying to head off at the other utilities still in the crosshairs.
The FBI and EPA’s recommended mitigations are unglamorous and mostly already known to anyone who has touched industrial control security: take PLCs off the public internet, change default credentials, segment the control network from corporate IT, and watch for the kind of unexplained configuration changes that the recent attackers have been leaving behind. The problem, as Censys’s exposure numbers illustrate, is that the mitigations only work for utilities that have actually inventoried what they have online — and the FBI’s alert is, in effect, an argument that a meaningful number of them have not.