FBI and EPA warn of cyber intrusions disrupting U.S. water utilities

A joint alert from the FBI and the Environmental Protection Agency highlights a wave of cyber activity aimed at internet-facing programmable logic controllers in the water and wastewater sector. Hackers have remotely breached vulnerable controllers, resetting credentials, changing IP addresses and modifying settings, which has led to service interruptions in multiple states. The notice specifically calls out Rockwell Automation’s Allen-Bradley MicroLogix 1100 and 1400 series as being targeted.

Agencies attribute the ease of exploitation to default passwords and outdated software on devices that are directly reachable via the internet. They warn that such exposure endangers critical infrastructure and urge water utilities to disconnect these controllers from public networks whenever possible. The advisory underscores growing concerns over the security of operational technology in essential public services.