Plant Controllers Left Open on the Internet: Attackers Broke Water Systems by Editing One Logic File

Plant Controllers Left Open on the Internet: Attackers Broke Water Systems by Editing One Logic File

The direct answer first: a programmable logic controller (PLC) is the small box that actually starts the pump, closes the valve and fires the alarm in your plant or facility. Since late July 2026, attackers have exploited exactly this kind of device — exposed directly to the public internet — at water utilities in at least 12 US states. They modified the operating logic inside them, disabled alarms and safe-shutdown routines, and changed passwords and network addresses until operators lost access to their own equipment. The impact was not leaked files but lost water pressure, flooding and plants forced into manual operation. If you run a production line or a building with control systems, the question to answer today is simple and specific: is there a single controller of yours reachable from the public internet?

What actually happened

The US Cybersecurity and Infrastructure Security Agency (CISA), the FBI and other federal agencies issued a joint advisory numbered AA26-097A, originally published on 7 April 2026 and updated on 22 July 2026. The update was not cosmetic: it added guidance for detecting malicious changes inside reusable code modules used in Rockwell Automation PLC programs, and expanded the scope of targeted hardware to include devices from Schneider Electric, Siemens and other manufacturers. On 30 July 2026 CISA published a separate alert urging the water and wastewater sector to protect its operational technology against activity specifically targeting PLCs.

The method deserves attention precisely because it is not brilliant, and involves no expensive zero-day. The attacker finds a controller exposed on the internet, then uses the official engineering software — the same software your own engineer uses — to download the project file and edit the ladder logic inside it. From there they tamper with Add-On Instructions to disable safe shutdowns and alarms, and falsify what the HMI and SCADA screens display, so the operator sees a perfectly normal reading while the tank or the line is doing something else entirely. Finally they change passwords and IP addresses on the devices and install a lightweight SSH service on the site modem to keep access alive after a reboot. The order matters: the visual falsification comes before the damage, which is why several operators noticed late.

The scale tells the rest. In Minnesota alone, more than 30 community water systems were reported as targeted, and the activity extended to other states including Michigan, New Jersey, Georgia and South Dakota. More telling than the count was the statement from CISA's acting director in August 2026: the team was still finding controllers open on the internet with no password set at all, or with the factory default still in place. His message to the sector was two sentences long: get your operational technology off the internet, and set a password.

Why this matters if you operate a facility in Saudi Arabia

Because it is the same hardware, the same vendors and the same habit. Rockwell, Siemens and Schneider controllers run production lines, treatment plants, building pumps, chillers and building management systems (BMS) in the Kingdom as they do everywhere else. And the habit that opened the door in those incidents exists everywhere: the installation contractor asks for remote access so he can serve you quickly, a port is opened on the site router or a standalone cellular modem is fitted, and then the temporary arrangement is forgotten and becomes permanent for years. Nobody documents it, nobody reviews it, and it never appears in any IT inventory — because it simply is not IT's.

That is exactly why Saudi Arabia's National Cybersecurity Authority issued the Operational Technology Cybersecurity Controls (OTCC-1:2022). They target sensitive industrial facilities across government and private entities and impose a minimum baseline of protection on industrial control systems. The document comes with a compliance assessment tool and a facility classification tool for determining how sensitive a given site is. If you operate in water, energy, manufacturing or facility management, these controls are not optional reading, and this summer's wave gives you an operational reason to pull your implementation schedule forward rather than push it back.

The real gap: IT is one world, OT is another

Most organisations approach operational technology security with an office-IT mindset, and that is the core problem. In the IT world your first priority is data confidentiality, you patch monthly, and you reboot a server at night with little real pain. In the OT world the first priority is continuity and safety; a controller may run for ten years without an update because stopping it means stopping production, its operating system is old by design, and the protocols it speaks were written in an era that assumed the network was genuinely isolated — so they include no authentication or encryption at all.

The consequence is that ordinary tools do not serve you here: antivirus on an HMI station can halt production, and a conventional vulnerability scan can knock over a sensitive controller. What does work is architecture: separate the networks, control the single crossing point between them, and make everything that leaves the operations world for the business world read-only.

Seven actions to take this week

• Inventory what is genuinely exposed. Ask for a list of every public IP tied to your sites, and every cellular modem installed in a control room. That list is usually longer than you expect, and contains devices nobody on the IT team knows about.
• Close direct access. No controller or HMI should be reachable from the public internet. Remote access goes through a VPN or a broker gateway, with multi-factor authentication and time-limited permission that is opened on demand and closed afterwards.
• Change every default password. Yes, the advice is old and boring — and it is precisely what investigators are still finding wide open at real facilities today.
• Segment the networks. The office network and the production network must not be one flat network. Traffic between them crosses a single governed, monitored point.
• Put the mode switch on Run. The physical key switch on the controller blocks remote logic downloads. A simple, effective setting that costs nothing.
• Keep an offline copy of controller logic and configuration. If the logic is altered or a password is changed, a trusted copy is the difference between recovering in hours and recovering in days.
• Monitor for change, not just for intrusion. The alert that matters here is not "there is a virus" but "the logic on controller 7 changed at 2:40am and no maintenance ticket was opened". Compare the running logic against the approved baseline on a schedule and log the differences.

Where this lands in the digitisation projects you are building

Every factory, warehouse or facility digitisation project brings the same request: we want a dashboard showing line performance live, and a phone notification if a pump stops. The request is entirely legitimate; the risk shows up in how it is implemented. The fast route is to connect the cloud system straight to the control network, or open a port so it can read from it — and that is exactly what turns a chain of incidents like this from foreign news into an incident at your own site.

The correct route costs only a few extra days: a data gateway in the middle that reads from the operations world and never writes to it, a single direction of data flow from production up to the business dashboards, a separate identity for each integration with the least privilege it can work with, and a tamper-proof log of every command travelling from the business system down to the floor. When we design operations, warehouse and maintenance systems at Origami, this separation is not a security item bolted on at the end — it is an architectural decision made on day one, because retrofitting it later means rebuilding the integration from scratch.

The practical lesson from this summer's wave is not that operational technology is dangerous. It is that its most commonly opened doors are also its simplest: a forgotten device on the internet, a default password, and a contractor's temporary access that quietly became permanent. Those three close with a management decision and a week of work, not an exceptional budget.

Sources

• CISA — joint advisory AA26-097A on the exploitation of programmable logic controllers across critical infrastructure (published 7 April 2026, updated 22 July 2026).
• CISA — alert of 30 July 2026 urging the water and wastewater sector to protect its operational technology.
• National Cybersecurity Authority — Operational Technology Cybersecurity Controls (OTCC-1:2022), with the full document available as a PDF.
• FBI — alert on cyber actors targeting internet-facing PLCs in the water and wastewater sector.