US Water Utilities Hit by Iran-Linked Cyberattacks Targeting Rockwell PLCs
Coordinated cyberattacks on water and wastewater utilities have been reported in at least twelve U.S. states since late July 2026. Federal investigators say the intrusions caused loss of monitoring and control, pressure drops and localized flooding, but no drinking‑water contamination was confirmed.
The attackers focused on Rockwell Automation/Allen‑Bradley programmable logic controllers that are directly reachable from the public internet. A Forescout scan identified 4,407 internet‑facing PLCs worldwide, including 2,844 in the United States, and 22 of those were located in cities where water‑system attacks occurred. Over 70% of the exposed U.S. controllers sit on large mobile‑carrier networks. While no specific vulnerability was proven, many of the devices are susceptible to CVE‑2017‑16740, a Modbus‑TCP denial‑of‑service flaw. The FBI and the Environmental Protection Agency issued a joint advisory warning of the campaign, which officials suspect is linked to Iranian‑backed actors.
Entities: Environmental Protection Agency · Environmental Protection Agency (EPA) · Federal Bureau of Investigation · Federal Bureau of Investigation (FBI) · Forescout · Rockwell Automation · State of Minnesota · U.S. water utilities · US water utilities
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [● 5 SOURCES] Hackers targeted Rockwell Automation/Allen‑Bradley PLCs, modifying IP addresses and passwords. (FBI, agency reports)
- [● 2 SOURCES] Many of the exposed PLCs are vulnerable to CVE‑2017‑16740, a Modbus‑TCP denial‑of‑service flaw. (Forescout analysis)
- [○ 1 SOURCE] Operational‑technology attacks are shifting from espionage and ransomware toward destructive intent. (Black Hat conference panel)
- [● 2 SOURCES] Forescout scan identified 4,407 internet‑facing Rockwell PLCs, including 2,844 in the United States. (Forescout research)
- [● 3 SOURCES] The attacks caused operational disruptions such as pressure loss and flooding but did not compromise drinking‑water safety. (FBI, state officials)
- [● 5 SOURCES] Cyberattacks have affected water and wastewater utilities in at least 12 U.S. states since late July 2026. (FBI/EPA joint advisory)
- [● 2 SOURCES] Twenty‑two exposed PLCs were located in cities that experienced water‑system attacks. (Forescout data)
- [● 2 SOURCES] Over 70% of U.S.-based exposed controllers are on large mobile carrier networks. (Forescout analysis)