CISA Logs 100+ Water PLCs Reachable via Cellular Modems in July 2026 Activity

CISA guidance released after the July wave details direct cellular modem attachments on programmable logic controllers in the Water and Wastewater Systems sector. The agency observed repeated scanning and access attempts across at least twelve states including Minnesota, Michigan, and Alabama. No operational disruption occurred, yet the incidents confirmed that default credentials and public internet exposure remain widespread in small utilities.

Procurement records and prior CISA alerts show Iranian-linked actors have repeatedly targeted Siemens, Schneider Electric, and Rockwell Automation devices since 2023. Technical indicators in the current wave consist of exposed OT ports rather than custom malware or command-and-control infrastructure that would support independent attribution. Official statements link the activity to Iran while independent verification of actor identity rests on unshared telemetry.

The pattern reveals a consistent institutional failure to enforce basic segmentation despite repeated warnings. Water utilities continue to rely on third-party cellular providers for remote access without jump hosts or MFA, a configuration repeatedly flagged in contract audits and incident reports. This exposure vector scales faster than regulatory enforcement.

CISA now directs utilities to inventory all internet-facing assets and remove unnecessary cellular connections within 30 days. Follow-on assessments will track whether exposure counts decline below the July baseline by the end of 2026.