Hackers Exploit Exposed Industrial Controllers to Disrupt US Water and Critical Infrastructure
Internet-connected industrial controllers, including Rockwell Automation/Allen-Bradley devices, are being exploited to disrupt US water utilities and critical infrastructure, leading to physical consequences like flooding.
Hackers are actively exploiting internet-connected industrial controllers to disrupt US water utilities and other essential services, with recent incidents demonstrating how poorly protected equipment can grant attackers direct access to physical operations. The consequences range from loss of monitoring capabilities to severe physical impacts such as flooding and reduced water pressure. These campaigns are not attributed to a single malware family but rather leverage a combination of exposed devices, weak passwords, insecure remote access, and legitimate engineering functions, allowing intruders to alter equipment operations without deploying sophisticated industrial malware.
Analysts from PolySwarm highlighted this escalating risk in an assessment published on October 5, 2026. Their report emphasizes that compromises to civilian infrastructure can indirectly affect military operations, as bases often rely on external utilities and suppliers. The assessment distinguishes between confirmed controller attacks and activities focused on reconnaissance or preparation for future disruptions, noting that some intrusions have already impacted physical processes while others establish access that could be weaponized during a crisis or conflict.
Beginning July 27, 2026, water and wastewater utilities across at least seven US states reported attacks targeting internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 controllers. Previous reporting has underscored the persistent concern surrounding industrial equipment accessible from public networks. In these incidents, attackers modified passwords and network addresses, hindering operators' ability to monitor or control equipment. At least one affected utility discovered altered controller project files and discrepancies in the programming logic governing physical processes, leading to reported consequences like flooding and loss of water pressure.
The FBI issued a warning that significantly reduced water pressure could potentially allow untreated groundwater to enter distribution pipes, raising concerns about contamination, though no actual contamination was confirmed during these specific incidents. Authorities have not publicly attributed the July campaign to any specific nation-state actor, cautioning against conflating it with separate Iranian-affiliated activity that also involved exposed industrial controllers and disruptive changes.
This threat landscape is further illustrated by earlier attacks against Unitronics controllers between November 2023 and January 2024, where the group CyberAv3ngers compromised at least 75 devices, including 34 in the US water and wastewater sector, by exploiting default passwords or unprotected devices. These attackers erased original control logic, installed replacement programming, and reconfigured devices, causing significant disruption.
The broader implications extend beyond individual utilities, with US agencies assessing that groups like Volt Typhoon aim to establish access for potential disruption during future crises, often using legitimate administrative tools and stolen credentials. Military installations, reliant on civilian services like electricity, water, and communications, could be indirectly impacted by disruptions to these critical support systems.
PolySwarm recommends several mitigation strategies, including eliminating unnecessary internet exposure, enforcing strong, non-default credentials, restricting remote access to authorized users, and vigilant monitoring of remote sessions. They also advise segmenting business and industrial networks, monitoring for cross-network intrusion paths, and developing robust recovery plans that preserve critical configurations and logic. Furthermore, utilities and military planners should map shared dependencies and rehearse responses to cascading outages, coordinating across cybersecurity, engineering, operations, and emergency management teams.
The report also includes Indicators of Compromise (IoCs) such as SHA-256 hashes associated with Volt Typhoon, though their deployment in the specific July water attacks or all discussed campaigns is not confirmed. These technical details serve as valuable intelligence for defenders seeking to identify and block related malicious activity.