Attacks on critical infrastructure: US water utilities in the crosshairs
At the end of July 2026 the FBI and the EPA issued a public warning (PSA I-073026). Since 27 July, water and wastewater utilities in at least seven US states have reported attacks, in some cases with operational effects. The targets were Rockwell/Allen-Bradley MicroLogix 1100 and 1400 controllers that were openly reachable from the internet. In parallel, more than 30 municipal water systems in Minnesota were attacked.
How the attackers worked
The attackers could reach the controllers because they stood open on the internet and were not adequately protected. On the MicroLogix 1400 there is a further point: the built-in web server ships with fixed default credentials (administrator/ml1400, guest/guest) which are often never changed.
The attackers changed the configuration of the controller by moving the IP address and setting a password. The control system lost its connection and its view of the process, and the operators were locked out of their own devices.
In at least one case the attackers changed the PLC project file itself, the ladder logic, that is the control program by which the PLC switches pumps and valves. That is the particularly risky part, because a manipulation of that kind can affect safety.
MITRE ATT&CK ICS
This is our own reading of the described behaviour, not a finding by the authorities. The FBI names no MITRE ATT&CK techniques for the MicroLogix wave.
| Tactic | Technique | What it means |
|---|---|---|
| Initial Access | T0883 Internet Accessible Device | controller open on the internet |
| Initial Access | T0822 External Remote Services | remote access over web server or modem |
| Execution | T0821 Modify Controller Tasking | altered control program |
| Lateral Movement | T0843 Program Download | uploading the altered program |
| Impact | T0829 Loss of View | IP change, the control system no longer sees the process |
| Impact | T0827 Loss of Control | operators locked out |
| Impact | T0826 Loss of Availability | disruption, fallback to manual operation |
| Impact | T0880 Loss of Safety | pressure loss and back-siphonage risk for untreated groundwater |
Controllers worldwide
Via Shodan, around 2,536 MicroLogix devices could be identified worldwide, about 2,215 of the 1400 type and 321 of the 1100. Most of them are in the United States.
Controllers in Europe
What does it look like in Europe and the DACH region? We identified around 582 openly reachable Rockwell devices across Europe. The MicroLogix 1100 and 1400 specifically affected make up about 330 of those, roughly 200 of type 1400 and 130 of type 1100, concentrated in Spain, Italy, Portugal and Poland. In the DACH region there is almost none, in Germany a single 1400.
These numbers have to be read carefully. Shodan shows only that a device is reachable, not that it was compromised. Whether the default password is still active is not visible from outside. Some of the hits may be honeypots or test systems.
Related incidents
There have been earlier attacks on Rockwell controllers, and they differ from this wave. In early 2026, CISA described attacks on the larger Rockwell Logix controllers through the Studio 5000 software in advisory AA26-097A, attributed to Iran and using CVE-2021-22681. The MicroLogix run on different software (RSLogix 500) and that CVE does not apply to them. So this is a separate campaign with different devices and a different way in. For defence the question of attribution is secondary anyway: an open controller with a weak password is reachable by anyone.
IoCs
There are no indicators for the MicroLogix warning itself. Only the related campaign AA26-097A includes attacker IP addresses as IoCs. They are useful for a retrospective search through your own logs, to check whether any of the addresses ever appeared, not as a permanent block list, because they age quickly. The machine-readable list is available as STIX in advisory AA26-097A.
What to take from it
How exposed are German and European utilities, and what do we take away? The affected product lines are barely present here, but the weakness is the same everywhere.
Initial access: too many controllers, panels and remote maintenance entry points stand open on the internet. The most effective step is to know your own assets and to allow remote access only through a secured gateway with MFA. A self-scan with Shodan or Censys against your own address ranges shows quickly what is visible.
Credentials: default passwords are still a problem in OT, here as elsewhere. Often a service provider uses the same password across many customers, and MFA is not implemented consistently. That usually surfaces during hardening or in an OT pentest.
Manipulated logic: after an incident like this, check whether the controller was manipulated. Logs from the OT sensors and PCAPs help. It also has to be established whether only the project file was changed or the firmware as well. The running program should be compared against a known-good version with the vendor’s own verification tools. And do not rely on the HMI display alone, because it can be falsified along with everything else.
Recovery: attacks happen. Practise emergency operation scenarios and have a clear recovery process, including tested offline backups of logic and configuration.
Sources:
https://www.ic3.gov/PSA/2026/PSA260730.pdf
https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a