Staff Reports
The federal government just widened an alarm bell every mayor needs to hear: a joint cybersecurity advisory from CISA, FBI, EPA and partners (product AA26‑097A) says hackers are actively exploiting internet‑facing programmable logic controllers (PLCs) that run municipal water systems. Utilities in at least seven states — including a coordinated wave that hit more than 30 Minnesota community systems — have reported intrusions that disrupted operations. The hard question for every city leader is simple: is any part of your water or wastewater control system reachable on the public internet?
What the advisory actually warns about
The advisory names real tactical moves attackers are using: they find PLCs exposed to the public internet, log in, change IPs and passwords, and sometimes alter control logic so operators lose view or control of pumps and valves. Vendors originally flagged include Rockwell/Allen‑Bradley devices, and the update broadened scope to include Schneider and Siemens gear. The agencies are distributing indicators-of-compromise (IOCs) and STIX data so defenders can hunt for breaches. Reported effects are not hypothetical — loss of pressure, flooding, and forced manual operation have already happened.
Why mayors should stop treating this like a remote IT problem
This isn’t a niche tech story. The GAO has reminded us the country has nearly 170,000 water systems and many are small, underfunded, and running legacy operational technology. EPA inspections found basic cybersecurity failures in more than 70% of systems reviewed: default passwords, shared logins, and stale accounts. Toss in contractor network designs reused across towns and you get a recipe that lets one successful scan multiply into a regional crisis. Attribution discussions about state‑affiliated actors are useful for headlines, but they don’t change the risk: exposed PLCs are an open door anyone can walk through.
Checklist for mayors: concrete steps to secure municipal water
If you run a city, demand answers and then demand action. Order your utility director to produce an inventory of internet‑facing OT devices and any vendor remote‑access paths. If devices are exposed, remove them from direct internet access or put them behind hardened VPNs or enterprise access proxies now. Rotate and remove default credentials, disable shared accounts, segment OT from IT networks, maintain verified offline backups of PLC project files, and test manual fallback procedures for pumps and treatment plants. Report suspicious activity to CISA/FBI/EPA, and insist vendors document network designs so one bad setup can’t cascade across towns. AA26‑097A gives IOCs and ports to hunt for — use them.
Mayors can’t outsource courage
Washington has been issuing warnings. Good. But guidance and voluntary programs won’t keep water on the tap if municipal leaders treat cybersecurity like a checkbox or a budget afterthought. This is public health and public safety, not a PR problem. Mayors who prefer ribbon cuttings to risk audits should remember: political careers survive fewer crises than children survive without clean water. Act now, secure those PLCs, and stop waiting for someone else to save your city’s water.
