In a July 30, 2026, public service announcement, the FBI and EPA said water and wastewater utilities in at least seven states had reported incidents involving internet-facing Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers (PLCs). The agencies said attackers changed device IP addresses and passwords, disrupting monitoring and control; at least one utility also reported altered PLC project files. The reports describe operational disruption, not confirmed drinking-water contamination.
What happened in the FBI and EPA warning?
The FBI and EPA said utilities had reported incidents to the FBI since July 27, 2026. The “at least seven states” figure reflects reports known to the agencies when they issued the July 30 announcement; it is not a final count of affected utilities or locations. The announcement names Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs, while advising organizations using other PLC brands to consider similar exposure risks. FBI/EPA public service announcement, July 30, 2026.
According to the FBI and EPA, actors remotely reached PLCs exposed to the internet, changed their IP addresses and passwords, and caused loss of monitoring or control. At least one organization reported modified PLC project files after finding ladder-logic discrepancies across several sites. The agencies did not identify a threat actor, motive, or exploited vulnerability in the announcement, so the reported activity should not be labeled as a particular group’s campaign or attributed to a CVE on this evidence.
What effects did utilities report?
The FBI and EPA reported loss of pressure and flooding. CISA’s same-day alert separately said the activity had led to boil-water notices and sustained manual operations. These are agency-reported impacts; the alerts do not establish that every incident had the same effects. CISA alert, July 30, 2026.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
The operational consequence depends on the PLC’s role, the equipment and process it monitors or controls, and whether operators can safely switch to manual operation. Losing a monitoring view differs from losing control of equipment, though either can complicate response. The FBI said pressure loss could potentially allow untreated groundwater to seep into pipes. That is a stated possibility, not confirmation that contamination occurred.
How should utilities secure PLC access?
Remove direct public exposure
Do not allow PLCs to accept direct inbound internet connections. Mediate any necessary remote operational access through a secured, monitored gateway or VPN, and limit communications to authorized systems. CISA’s bulletin says, “Remote access for operational purposes should go through a VPN or gateway device, not directly to the PLC.” A gateway or firewall is one part of a control-system design, not a stand-alone guarantee of security.
Rank #2
Include cellular modems in the inventory
CISA warned that cellular modems used by operators, vendors, or integrators may be undocumented and missed by routine exposure scans. Inventory field and vendor-installed connections as well as known corporate-facing links. Secure modems with strong authentication, current updates where available, and logging; verify that each connection has an identified owner and approved purpose.
Harden credentials and communications
- Replace default or weak passwords with unique, strong credentials.
- Use firewall rules or access-control lists to allow only expected communications between authorized control-system devices.
- Review and monitor remote-access paths rather than relying on password changes alone.
Prevent unapproved logic changes
Use physical or software keyswitches to prevent unauthorized program or configuration changes where supported. Preserve known-clean PLC images and backups, and verify project files and logic before restoring or returning a controller to operation. The FBI and EPA caution that changing a PLC’s mode can lock in the current project file; do not put a controller into run mode until its project has been validated.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
What should a utility do if it loses PLC access?
- Use the incident plan and assess process safety. Determine which equipment and functions are affected, and follow established procedures for safe manual operation or other approved fallback modes.
- Preserve evidence and identify the scope. Record the time and nature of the activity, affected equipment and locations, and review connected modems, HMIs, and workstations for signs of related activity.
- Restore only from verified clean files. Compare controller projects and logic against known-good backups before restoring; validate the project before changing operating mode.
- Report the incident. The FBI/EPA announcement directs affected organizations to contact their local FBI field office and the Internet Crime Complaint Center (IC3). CISA’s alert lists useful report details: date, time and location; activity type; affected people and equipment; and the submitting organization and contact.
The FBI and EPA emphasize the importance of manual fallback: “The capability for organizations to revert to manual controls to quickly restore operations is vital in the immediate aftermath of an incident.” Utilities should practice these procedures, not merely document them. FBI/EPA protection recommendations.
How should utilities prepare for recovery and end-of-life equipment?
Test continuity and recovery
Practice safe manual operations and test continuity, fail-safe, islanding, standby, backup, and recovery procedures. Confirm who can authorize a fallback or restoration, which records and clean project files are available, and how operators will maintain safe service while monitoring or control is impaired.
Track equipment that no longer receives security updates
The FBI and EPA say end-of-life (EOL) hardware no longer receives manufacturer software updates or security patches. Maintain an inventory that records model, owner, location, support status, and retirement date. Their PSA recommends reviewing a rolling 12-month EOL forecast quarterly. Replace or isolate unsupported assets where feasible; if compensating controls are needed, assign them a firm decommission date rather than allowing them to become permanent by default. These are planning recommendations, not statistics about the campaign.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Where can water utilities get official assistance?
The FBI/EPA announcement identifies local FBI field offices, IC3, CISA’s 24/7 Operations Center, and EPA water-sector Cybersecurity Technical Assistance as reporting or support pathways. EPA’s water-sector resource hub also lists assessments, technical assistance, incident-response guidance, exercises, and funding resources. EPA water-sector cybersecurity resources. For reporting to CISA, include the incident’s date, time and location; activity type; affected people and equipment; and the reporting organization’s contact information, as requested in CISA’s alert.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Best Value
- Application Scenes. USB programming cable Compatible for Allen Bradley PLC SLC 5 5 5 SLC500 and Micrologix1400. This cable is for transferring program/data between computer and PLCs, for USB-1747-CP3 Replacement.
- Converter Cable. USB 2.0 male to DB9 female adapter. Anti-interference. Its power is supplied by PC USB port. With LED communication indicators. Completely compatible with USB 1.1 and USB CDC V1.1.
- Supported OS and Driver. Support Windows 98XPVista 0 8 . Under the control of driver, the PC USB port is simulated as traditional COM. One key installation driver.
- Quality Cable. The original chip and SMT PCB built inside, every cable is tested manually.
- Technical Support. Scan the QR code printed on the label on the box, you can find, download and install the cable driver. Also, User Manual and Cable Driver will be sent to you by Email via Amazon platform, if you didn’t receive it, please contact our engineers by Email for technical support. Made by Washinglee, 1 year warranty.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
