C0066 2026 U.S. Water Utilities Attacks

2026 U.S. Water Utilities Attacks was a campaign against more than 30 municipal water and wastewater utilities in Minnesota, beginning 27 July 2026, amid a wider pattern of similar activity the FBI and EPA reported across at least seven U.S. states. The adversary targeted internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series programmable logic controllers reachable through cellular gateways at water towers and sewer lift stations, remotely accessing them and reconfiguring their IP addresses and passwords to lock operators out of monitoring and control functions. At least one victim organization's PLC program logic was altered, and reported operational effects included loss of water pressure and flooding, with one utility taking its treatment plant offline entirely. The campaign has not been formally attributed; some reporting describes the broader pattern as consistent with Iranian-affiliated activity, but attribution for the Minnesota intrusions specifically remains unconfirmed.