CISA confirms attacks on more than 100 US water systems in July

The United States' cybersecurity agency, CISA, confirmed it observed attacks on more than 100 internet-exposed systems in the country's water and wastewater treatment sector during July, according to a TechCrunch report. The number gives real scale to a wave of intrusions that had already been reported in Michigan, Minnesota and at least five other states.

The central target wasn't web servers or corporate databases, but programmable logic controllers (PLCs), the industrial computers that command pumps, valves, chemical dosing and other physical equipment at treatment plants. It's the layer where software meets the physical world, and that's exactly where the attack surface tends to be most neglected.

What the attackers were able to do

According to CISA, the attacks hit PLCs from several manufacturers: Rockwell, Schneider Electric and, more recently, Siemens. The agency had already reported that part of the intrusions use AI tools fed with publicly available information to generate scripts capable of exploiting vulnerable Siemens PLCs, a sign of how automation is lowering the barrier to entry for attacks on industrial systems.

The most concerning point in the report: in some cases, attackers were able to modify the PLCs to disable shutdown processes and alarms. In practice, this means altering the control logic of a physical system without the operator being notified, creating what CISA described as "unsafe conditions." This isn't a data leak. It's the possibility of manipulating equipment that treats the water a community drinks.

So far, the impact on water supply has been limited, but there were interruptions and shutdowns while incident response teams investigated the intrusions. Much of the affected communities are in rural or isolated areas, where a single plant serves a large territorial area, which amplifies the reach of any disruption.

Who is behind it

Reports citing US officials indicate that American intelligence believes Iran is likely behind the attacks, described as largely opportunistic, possibly in response to the war led by the US and Israel against the country. Officials, however, have not made a concrete, definitive attribution.

The case adds to a broader scenario of geopolitical tension in cyberspace. US authorities have already warned that hackers linked to China planted destructive malware in critical infrastructure, ready to be activated in the event of an invasion of Taiwan. Russia, for its part, has been linked to attacks against water suppliers and power grids in Europe, seen as tests against the NATO alliance.

The recurring technical pattern: internet-exposed OT

The detail infrastructure devs need to internalize is the phrase "internet-exposed systems." PLCs and SCADA systems were designed decades ago to operate on isolated (air-gapped) networks, with no expectation of being publicly accessible. Many classic industrial protocols, like Modbus, have no authentication or encryption by design.

The problem arises when this equipment gains connectivity for remote monitoring, cloud integration or plain operational convenience, and ends up reachable over the open internet. Tools like Shodan routinely catalog thousands of publicly accessible PLCs and HMI interfaces around the world. This is exactly the kind of exposure the opportunistic attacks described by CISA exploit: you don't need a sophisticated zero-day when the controller responds to any request coming from outside.

Why this matters for those building software in Brazil

Brazil has a fragmented sanitation structure, with hundreds of municipal operators and state-owned companies such as Sabesp, Copasa and Sanepar (Brazil's state water and sewage utilities), plus private concessions expanding after the country's new sanitation legal framework. Many of these operations are going through digitization and telemetry processes, which means more PLCs and IoT sensors connected to networks that, historically, weren't designed to withstand attacks.

For the dev or engineer working with utilities, industrial automation or IoT in the country, the American episode is a direct case study. A few practical points the incident reinforces:

• Network segmentation is non-negotiable. OT (operational technology) networks should be physically or logically separated from corporate IT networks, following models like the Purdue reference architecture. A PLC should never be directly accessible from the internet.
• Inventory and visibility. Many organizations don't even know how many devices they have exposed. A survey using discovery tools and checking your own external surface (including via Shodan) is step zero.
• PLC authentication and patching. Manufacturers like Siemens, Schneider and Rockwell regularly publish security advisories. Keeping firmware updated and changing default credentials remains a basic step frequently ignored.
• Monitoring logic changes. Since attackers tampered with the controllers' own programming, detecting unauthorized changes to control logic becomes as important as detecting malicious traffic.

What remains open

CISA hasn't publicly detailed all the specific vulnerabilities exploited, and the attribution to Iran remains officially unconfirmed. It's also unclear how many of the affected systems have already been fully remediated. What the episode makes clear is that the cybersecurity frontier has definitively shifted from the office to the factory floor and infrastructure plants, and that the arrival of AI in generating attack scripts tends to accelerate the scale of the problem. For those who write or operate software that touches the physical world, treating OT security as a second-tier concern is no longer an option.