CISA Advises Utilities to Secure PLCs Following Minnesota Cyberattacks
Between July 26 and 27, a coordinated cyberattack impacted operational technology systems at more than 30 community water utilities in Minnesota, as reported by Minnesota IT Services (MNIT). The agency activated its cybersecurity incident response capabilities immediately upon learning of the attacks, which are still ongoing. Four cities—Braham, Maple Plain, Plymouth, and South St. Paul—have publicly disclosed the incidents, with Braham experiencing the most severe disruption, as its water plant was completely taken offline after attackers disabled its computerized controls.
While state and federal investigators are working to determine the source of the attacks, the timing coincides with a recent CISA advisory regarding Iranian-affiliated actors targeting programmable logic controllers across U.S. critical infrastructure. Although no formal attribution has been made, Tenable researchers suggest that the operational patterns align with those of the CyberAv3ngers group, which is linked to Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command.
CISA has issued a warning about a surge in attacks on internet-exposed PLCs at water utilities, where attackers have changed passwords and IP addresses to lock out operators, leading to boil water notices and forcing some facilities to revert to manual operations. The agency emphasizes the urgent need for organizations to remove publicly accessible PLCs and other operational technology systems from the internet.
The FBI has confirmed that utility companies in at least seven states have reported incidents related to PLCs. The attacks, while not technically sophisticated, involve remotely accessing internet-facing devices and altering their settings, resulting in a loss of monitoring and control. This vulnerability is exacerbated by the use of default or weak credentials on exposed hardware.
A critical vulnerability in Rockwell Automation systems, identified as CVE-2021-22681, has been actively exploited by Iranian-affiliated threat actors since March 2026. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, noting that no security patch is currently available, making network isolation and other compensating controls essential.
CISA's alert highlights that threat actors are targeting water entities of all sizes, urging even those with mature cybersecurity processes to validate their external connections. This includes cellular modems installed by operators or vendors that may not be documented in routine scans. The advisory also notes that attacks have expanded to include devices from Schneider Electric and Siemens, with attackers now stealing PLC project files, indicating a shift towards reconnaissance for future targeted attacks.
The Minnesota attacks have resulted in boil water notices and ongoing manual operations at affected utilities, although drinking water remained safe in most cases. The cities impacted are not isolated rural facilities but include significant communities. Experts believe that small and rural facilities are particularly vulnerable due to limited cybersecurity resources, making them attractive targets for attackers.
CISA's alert stresses the importance of validating external connections, including undocumented remote access paths. The agency recommends that organizations disconnect PLCs from the internet, segment operational technology networks from IT networks, change default credentials, and audit all remote access points. Following these recommendations can help mitigate the risks posed by cyber threats to critical infrastructure.
