The FBI and Environmental Protection Agency are warning that cybercriminals have targeted internet-connected equipment used by water and wastewater utilities, disrupting operations in multiple states.
In a Public Service Announcement issued July 30, the agencies said malicious cyber actors have been targeting Operational Technology devices used to control water infrastructure.
According to the FBI, the attacks have affected water and wastewater utilities in at least seven states since July 27, with some incidents disrupting normal water operations.
Federal officials said the attackers specifically targeted Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers, commonly known as PLCs, though they cautioned that similar vulnerabilities could exist in other brands of controllers.
The FBI said the attackers remotely accessed internet-facing PLCs, changed internet protocol addresses and passwords, and caused utilities to lose monitoring and control capabilities.
According to the agency, cyber actors altered device configurations by modifying IP addresses and enabling passwords, resulting in a loss of visibility into, and in some cases control over, connected equipment.
Federal officials also said at least one organization discovered unauthorized changes to PLC project files after identifying discrepancies in ladder logic across multiple facilities.
The FBI believes similarities in network configurations used by third-party providers may have enabled attackers to compromise multiple organizations using comparable systems.
Officials said reported operational impacts have included flooding and temporary losses of water pressure.
The FBI warned that reduced water pressure could create conditions allowing untreated groundwater to enter portions of a water distribution system.
Although utilities in at least seven states have been affected, the FBI has not identified the states involved.
Officials said there have been no confirmed cyberattacks involving Alabama water systems.
The Alabama Department of Environmental Management has urged municipal water and wastewater operators across the state to conduct cybersecurity assessments and review internet-connected equipment as a precaution, per Wire Grass Daily News.
According to state officials, there have been no reported water service interruptions, pressure losses or boil water advisories in Alabama connected to the cyber campaign.
The FBI and EPA are urging utilities to disconnect programmable logic controllers from the public internet whenever possible and instead use secure gateways and firewalls.
Federal officials also recommend using strong, unique passwords, restricting network access, reviewing project files for unauthorized modifications, maintaining the ability to manually operate systems and replacing outdated equipment that has reached the end of its service life.
In addition, the agencies encouraged utilities to review system logs and device configurations, verify backups before restoring systems and immediately report suspicious cyber activity.
The FBI asked organizations experiencing potential attacks to notify the bureau, the Internet Crime Complaint Center and the Cybersecurity and Infrastructure Security Agency so investigators can track and respond to the ongoing campaign.
