The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a significant increase in attacks targeting internet-exposed programmable logic controllers (PLCs) in the water and wastewater systems sector. The agency is highlighting growing threats to critical infrastructure that could disrupt essential water services across the country.
The warning comes as several community water systems have been targeted, with attackers focusing on PLCs that control water treatment and distribution processes. These systems are increasingly connected to the internet, creating new attack surfaces that threat actors are actively exploiting.
Why This Matters: Water utilities are critical infrastructure, and attacks on these systems can have immediate, life-threatening consequences for communities. The increase in targeting PLCs represents a shift from traditional IT attacks to operational technology (OT) attacks, which can cause physical harm. Organizations must prioritize securing these systems with air-gapping, network segmentation, and regular security assessments.