CISA is warning water and wastewater system operators to secure internet-exposed PLCs after a surge in attacks on OT across the sector, including incidents that mirrored disruptions seen in Minnesota. The agency advises immediate steps such as removing exposed controllers from the internet, enforcing strong access controls, and reviewing activity linked to vendors and devices highlighted in AA26-097A. #CISA #Minnesota #AA26-097A #RockwellAutomation #SchneiderElectric #Siemens #CyberAv3ngers #Handala
Keypoints
- CISA says threat actors are increasingly targeting PLCs in the water and wastewater sector.
- Exposed OT devices should be removed from the internet as soon as possible.
- Attackers have changed passwords and IP addresses to disrupt operator access.
- Recent attacks in Minnesota affected automated controls at more than 30 water systems.
- CISA urges VPN access, strong passwords, IP allowlisting, and clean PLC backups.