Staff Reports
The FBI issued a blunt warning late in July after utilities in at least seven states reported cyber incidents that interfered with municipal water and wastewater systems. The alert says attackers are probing and exploiting internet‑exposed programmable logic controllers (PLCs) used to run pumps, valves and monitoring gear. This is not a dry technical memo — it is a clear signal that our water system security is being tested and, in some places, found wanting.
What the FBI found: PLCs on the hook
The FBI’s public service announcement names specific PLC models being targeted and describes how the intruders operate. Officials said Rockwell Automation/Allen‑Bradley MicroLogix 1100 and 1400 PLCs were observed in the recent incidents, though other devices could be vulnerable. Attackers who reach internet‑facing PLCs have changed IP addresses and passwords, locked out operators, and in at least one case altered control logic. The result: loss of automation, alarms, pressure drops and flooding in some systems — the kind of operational chaos that can quickly become a public health risk.
Small towns felt it on the ground — not just in headlines
These are not theoretical attacks on virtual targets. Minnesota officials reported coordinated activity that affected more than 30 community water systems, with some towns forced to run systems manually or rely on stored tower water. Michigan reported several systems saw degraded operations as well. Federal and state officials say there’s no evidence yet that drinking water was contaminated, but loss of pressure can allow untreated water in — and that’s a close call no one should accept.
Politics, blame and the hard job of fixing it
Predictably, political knives came out. President Trump publicly criticized Minnesota leadership, and Governor Tim Walz pushed back. Fine — politicians like to toss blame like confetti. But pointing fingers won’t patch PLCs or fund cybersecurity upgrades. What will help is honest accountability, clear standards, and steady funding so local operators can isolate internet‑exposed devices, replace end‑of‑life gear, and adopt secure remote access practices the FBI and CISA recommend.
Practical fixes and a simple demand
The FBI and other agencies gave a checklist: remove PLCs from direct internet exposure, put secure jump hosts in place, lock down cellular modems, enforce strong unique passwords, keep validated offline backups, and be ready to switch to manual operations. Municipal leaders and Congress should treat water system cybersecurity like what it is — basic infrastructure defense. If you run a town, keeping the water flowing and safe is job one. If officials won’t do that, voters should find people who will.
