AINEWS
An FBI EPA warning says intruders took control of equipment at water utilities in at least seven states. The fix is structural, and it starts at the local water board.
On July 30, the FBI and EPA issued a joint warning that since July 27, attackers have been reaching into the control computers at small water utilities in at least seven states. In some plants, the intruders changed the network settings and passwords on equipment inside the water plant itself, cutting operators off from the ability to monitor or run their own systems, according to the FBI press release and a parallel CISA alert.
The deeper story is not the intrusions themselves. It is the structural mismatch the warnings reveal: most of the affected equipment is decades-old, internet-exposed control gear, and most of the operators are small municipal utilities with thin cybersecurity budgets. Federal warnings can describe the fix. They cannot enforce it.
According to the joint FBI-EPA Public Service Announcement, the activity has hit Water and Wastewater Sector facilities running Rockwell Automation and Allen-Bradley MicroLogix 1100 and 1400 controllers, the kind of small industrial computers that run pumps, valves, and chemical feeders at thousands of municipal water plants. After remotely logging in to devices that were exposed to the public internet, the actors changed the device's IP address and password, which severed the utility's ability to see or control that piece of the plant.
The Hacker News reports that more than 30 Minnesota water systems saw coordinated targeting, and at least one plant was forced offline. The FBI said intrusions have affected utilities in at least seven states since July 27.
The federal agencies have not publicly attributed the activity to a named country or group. Reporting by The New York Times points to Iran-linked actors, but the attribution is a separate sourcing claim that the advisories themselves do not make. The operational pattern in the warnings stands on its own.
The technical entry point is not exotic. Rockwell's advisory PN1612 documents an unauthenticated cross-site scripting flaw in the embedded web server on MicroLogix 1100 and 1400 controllers that can lead to remote code execution. Older issues, including a previously unresolved buffer overflow in the MicroLogix 1400, are documented in Rockwell advisory PN949. Once a controller of this class sits behind a public IP address with a default or shared password, the door is open.
Federal mitigation guidance is concrete and well-known: pull the controller off the public internet, put it behind a secure gateway or firewall, set a strong unique password, and use an access control list to limit which devices can talk to it. The FBI-EPA PSA repeats the same steps.
The harder problem is governance. As one commenter on a Hacker News technical discussion of the incident put it, U.S. water systems number on the order of 148,000 independent operators, most of them small municipalities running plants on equipment lifecycles measured in decades. CISA can publish the playbook. It cannot compel a town water board to follow it. That is the gap the latest intrusions are walking through.
The fix is not theoretical. Two near-term moves cover most of the risk surface: move the control computer off a public IP and onto a private network, and change the default password to a long unique one that only the plant's control vendor and operations staff know. The federal guidance lists both.
Water and sewer boards are usually public-meeting bodies. They have to answer constituent questions, and the question worth asking is whether the utility's control gear sits behind a gateway and a unique password, or is reachable from the open internet. If the answer is not on the public record, it is reasonable to ask for it in writing. A community that knows the answer is harder to hit than one that does not.
The FBI and EPA have done the part they can. The rest lives one water board meeting at a time.