Executive summary: 30+ Minnesota water systems were struck by a coordinated cyberattack on July 26-27. Days later, Michigan confirmed similar breaches at nine of its own water systems. The pattern highlights how a single design flaw in OT cybersecurity became a national attack surface.
On July 30, 2026, the FBI and EPA issued a joint PSA (Public Service Announcement; Alert I-073026-PSA) going into more detail about the Minnesota attack. Per the advisory, the actors gained remote access to internet-facing PLCs and changed their IP addresses and passwords, cutting off operators' monitoring and control functionality. At least one organization also found modified PLC project files after noticing ladder-logic discrepancies across several sites, and the FBI noted that similarities in network setups provided by third parties may have let the actors repeat the same technique across multiple customers.
On August 1, another attack was made public. This time, Michigan's Department of Environment, Great Lakes, and Energy confirmed cyberattacks on nine of its water systems, days after Minnesota reported similar breaches across the state.
Federal officials pointed to Iran as a leading suspect; however, attribution is preliminary and the FBI is still investigating both states' incidents.
Across the affected communities, public works staff switched to manual operations, allowing water and wastewater services to continue without interruption while automated control was compromised. That's an operational win, and Minnesota's operators deserve credit for it. Manual fallback worked this time, but it might not work the next.
Critical Infrastructure can’t always rely on their plant operators’ vigilance to substitute for the absence of a secure architecture.
A Preventable Pattern, Repeated for Years
While it would be somewhat convenient to treat the attack as an isolated Iran incident, a one-off closely connected to the existing tensions with Iran, the attack on US Critical Infrastructure is a pattern.
According to a joint EPA enforcement alert, CISA, the FBI, the National Security Agency, EPA, and other federal entities have issued numerous advisories for cyberattacks against information networks and process control systems at water and wastewater systems by state-sponsored cyber actors. To name just a few:
- Iranian Government IRGC-affiliated cyber actors
- Pro-Russia hacktivists
- State-sponsored cyber actors from People's Republic of China known as Volt Typhoon, Vanguard Panda, and other names.
The Minnesota and Michigan incidents are just the latest data points in a threat landscape federal agencies have been describing, in writing, since at least late 2023.
Access to clean water is a basic human right; a plant that can't verify its own chemical dosing or pressure controls is a national public health crisis waiting to happen.
In the words of EPA Administrator Lee Zeldin, the responsibility sits with the people running the plants. The advisories have been public for years, and operators shouldn't wait for a federal mandate to fix their systems.
Many PLCs, including the MicroLogix units at the center of this incident, are legacy hardware that may no longer receive security updates, built for the plant floor, not the internet. If these controls are exposed, a small intrusion will create real operational disruption for communities large and small.
How the Pattern Plays Out in the Minesotta Attack
A typical OT attack often begins with a phishing email that compromises an IT user or endpoint. The attacker then escalates privileges through Active Directory, pivots from the IT network into the OT environment, compromises an engineering workstation, and ultimately gains access to PLCs to manipulate or disrupt industrial processes.
In the Minnesota attack (at least) the attackers skipped almost all steps. As it appears, the attackers didn't need to compromise the corporate IT network first; they simply found and exploited PLCs directly exposed to the Internet.
Based on the available information, it is possible that the attackers obtained administrative access to the PLCs by exploiting default credentials, weak passwords, or the lack of MFA (multi-factor authentication) policies. This allowed them to bypass the traditional IT-to-OT attack path, significantly reducing the number of steps required to compromise the controllers.
The attack chain demonstrates why Level 0-1 devices should never be Internet-accessible.
Network Controls Aren't Enough for Operational Technology
The attack chain demonstrates why Level 0-1 devices should never be Internet-accessible.
As for best practices in OT cybersecurity, the FBI, EPA, and CISA correctly recommend removing internet exposure, implementing firewalls, VPNs, network segmentation, and strong authentication policies. These remain foundational controls and should be implemented wherever remote access is required. However, for high-consequence industrial control systems, orgs should question whether remote inbound access is required at all.
VPNs and firewalls are software pieces, which means they have vulnerabilities. They're configured by people, which means they can be misconfigured. The same actors who spent July scanning the internet for exposed PLCs can just as easily point those same scanners at vulnerable or misconfigured VPN endpoints and firewalls next. It's the same problem with a different search query.
No controller responsible for water, power, transportation, or other essential services should be directly reachable from the public internet. There's a difference between "secure" and "isolated," but that’s where some utilities' cybersecurity systems fail.
VPNs authenticate and encrypt remote access, while firewalls regulate which traffic is permitted. Both assume that some level of inbound connectivity remains available. A unidirectional gateway, or data diode, addresses a different security objective: eliminating inbound network connectivity entirely for systems that do not require remote control.
How One-Way Flows Eliminate an Entire Class of Risk
Widely, industrial communications fall into 2 categories:
1. Control traffic, which sends commands into processes.
2. Monitoring traffic, which exports operational data to historians, SOCs, enterprise applications, cloud analytics or management portals.
Many critical systems end up using only the second category. In these environments, allowing inbound connectivity simply increases the attack surface without providing operational value.
If operational data does need to leave, it shouldn't travel on a path that allows anything to come back in. It should cross a hardware-enforced, physically one-way boundary instead.
With a one-way enforced flow, operators keep full visibility into what's happening on the plant floor. Attackers, on the other side, get no opportunity to come back through that connection.
This is the principle behind OPSWAT’s MetaDefender™ NetWall: next-gen Data Diodes, providing unidirectional security. MetaDefender NetWall implements hardware-enforced one-way communication, moving operational data like historian info, alarms, logs or telemetry from critical OT to enterprise systems while preventing any network sessions, management traffic, or control commands from traversing back towards the protected controllers.
There’s no need to secure the return path, because it doesn’t exist in the first place. This eliminates the class of vulnerability a firewall can't fully close: a misconfigured rule, an open port, or a policy exception. Human error as a risk factor is also completely removed, since diodes don’t require the complex two-way configuration rules used by firewalls. MetaDefender NetWall is built to meet rigid security requirements in industrial environments, as well as EPA recommendations for water sector resilience.
10K Hosts Are Still Exposed; How Do We Close the Gap?
Right now, more than 4,100 internet-exposed Rockwell Automation/Allen-Bradley hosts, over 4,100 Siemens hosts, and more than 2,000 Schneider Electric hosts sit reachable from the open internet. According to CISA, cellular modems added by operators, vendors, or system integrators are a frequent blind spot because they are often undocumented and therefore omitted from routine attack-surface scans.
In other words, +10k devices are exposed to the exact class of attack which just hit Michigan and Minnesota water utilities. Using controllers that, if compromised, can flood a plant or leave water untreated. CISA uses VPNs and firewalls as baseline recommendations for protecting US Critical Infrastructure. While they have real merit, we’re still talking about internet-based tools. The current advice for protecting a pressure valve, a chemical feed, and a family's tap water can’t be in the same category of tools built to protect a login page.
Minnesota and Michigan are a reminder that internet-grade security was never built to be the last line of defense for physical, public-safety-critical systems. Public safety infrastructure needs a physical answer; a boundary attackers can't reconfigure, exploit, or scan their way through, because there's no return path for a scanner to find.
The first episode of OPSWAT’s new documentary series, hosted by Kari Byron of MythBusters, makes the case in the open: multi-layered defense, including hardware-enforced one-way data flow, isn't a nice-to-have for critical infrastructure. In fact, it can become the difference between an incident report and a public health emergency.
"Breaking the Firewall" takes viewers from security conference floors to hands-on demonstrations of exactly how firewalls fail, and what must replace them. Watch Episode One and learn what it takes to secure America's critical infrastructure.
