CISA Urges Water and Wastewater Systems to Protect OT Against Activity Targeting PLCs
Summary
CISA issued an urgent alert urging the Water and Wastewater Systems Sector to protect operational technology (OT) environments against malicious activity specifically targeting programmable logic controllers (PLCs). The alert follows last week's coordinated cyberattack that disabled OT at 30+ Minnesota water systems (covered 30 July) and continues a wave of OT-focused guidance from CISA and the ACSC.
Key Details
- Date: 2026-07-31
- Source: CISA
- Reliability: Tier 1/4 — Official / first-party
- Sector: Water and Wastewater Systems
- Target: Programmable Logic Controllers (PLCs)
- Context: Follows coordinated cyberattack disabling OT at 30+ Minnesota water systems
- Related: ACSC CI Fortify guidance on isolating OT networks
Source
See Also
- CISA Adds One New Known Exploited Vulnerability to KEV Catalogue
- CISA Publishes Open Source Software Security Principles and Practices
- Cyber Extortionists Steal Data from UK Department for Education
Australian and New Zealand relevance
The alert is directly relevant to Australian water utilities regulated under the SOCI Act and the ACSC's CI Fortify guidance on OT isolation, and to NZ water infrastructure under the NCSC's critical infrastructure framework. The Minnesota water system attacks demonstrate the real-world risk of OT-targeted cyberattacks against critical water infrastructure.