CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs

Executive Summary

CISA is observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other OT from the internet. Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected PLCs by changing IP addresses, resulting in boil water notices and sustained manual operations. Water entities of all sizes are targeted, including through undocumented cellular modems.

Municipal Impact

Highly relevant to municipal water and wastewater utilities, which are frequently SLTT-owned; CISA notes even organizations with mature cybersecurity processes should validate external connections including undocumented cellular modems.

SMB Impact

Relevant to small water/wastewater operators and system integrators; OT assets exposed to the internet face increased risk of defacement, configuration changes, operational disruptions, and physical damage.

Recommended Actions

1. Disconnect PLCs from the internet; route operational remote access through a VPN or gateway device, not directly to the PLC.
2. Enable password protection and change default passwords.
3. Allowlist IPs to only allow remote access from known engineering laptops or other critical OT assets.
4. Validate all external connections, including cellular modems installed by operators, vendors, or system integrators.

Grey Matter Analysis