When 30 Water Utilities Get Hit in 48 Hours, the Lesson Isn’t “Better Malware” — It’s “No Front Door”

Key Takeaway: In July 2026, a coordinated attack disrupted more than 30 Minnesota water utilities in under 48 hours, briefly taking one treatment plant's controls offline. Investigators found no sophisticated malware — attackers located internet-exposed PLCs, logged in with default credentials, and altered control logic directly. The incident reinforces a CISA-recommended shift in OT security priorities: removing internet-facing exposure eliminates more risk than adding detection tools. Four architectural changes address the specific gap these attacks exploited: brokering remote access, isolating cellular connectivity, eliminating default credentials, and baselining control logic. 

What Happened: 30+ Minnesota Water Utilities Hit Through Exposed OT Remote Access

Over roughly 48 hours, more than 30 Minnesota municipal water utilities reported cyber attacks. In at least one town, the attack shut down the plant’s operating controls for about two hours before crews restored them manually. Luckily, public health was not harmed and water stayed safe — but the access was real, and it was fast, coordinated, and broad.

The timing of the attacks is hard to ignore: just days earlier, the FBI and CISA re-issued a joint advisory (AA26-097A) warning that Iranian-affiliated actors are actively targeting internet-exposed programmable logic controllers (PLCs) across U.S. critical infrastructure. The Minnesota incidents have not been formally attributed, but they fit the pattern the advisory describes — exactly.

Why This Wasn't Sophisticated — It Was Exposed ICS, Not Advanced Malware

The playbook these threat campaigns use is depressingly simple:

1. Scan the internet for PLCs, RTUs, HMIs, and cellular field modems that answer on standard industrial ports. 

2. Log in — often with default or no credentials.

3. Change the logic — modify or delete the controller’s program, alter what operators see on their screens, and in the worst cases disable the shutdown and alarm logic so the process can drift into an unsafe state without anyone being alerted.

No zero-day. No custom implant. The vulnerability is architectural: the device was reachable from the internet in the first place.

Why Detection Alone Can’t Secure Internet-Exposed OT Devices

A lot of OT security spending goes toward seeing attacks faster. That matters — but you cannot monitor your way out of an exposed PLC. If a control system is directly reachable from the public internet, you are relying on the attacker to be slow and your alerting to be perfect. The Minnesota operators who fared best weren’t the ones with the best dashboards; they were the ones whose exposed surface was smallest and who could fall back to manual control.

The most effective control is the one CISA now lists first: remove inbound exposure. If there is no front door, the scan-and-walk-in playbook has nothing to knock on.

How to Eliminate Internet-Exposed OT Access: 4 Steps

Practically, four moves close the gap the Minnesota attackers exploited:

1. Move control systems off the public internet with brokered remote access. No PLC, RTU, or HMI should be directly reachable. All remote access should be brokered through a secure gateway that mediates, monitors, and records every session — so a human (or a stolen credential) can never talk straight to a controller.

2. Isolate cellular and field connectivity with zero-trust network access. Remote sites on cellular modems are the soft underbelly. Put them behind private APN, zero-trust network access, or site-to-site tunnels, with strong authentication and logging on the modems themselves.

3. Kill default credentials on every device, and restrict device-to-device traffic to only what the process actually needs.

4. Baseline your control logic so an unauthorized change to a PLC program is detected, not discovered during an outage.

The Mental-Model Shift: From Detection to Eliminating Standing Exposure

The takeaway from Minnesota is not “buy more” security tools. It’s a change in how we need to think about exposure. Every internet-reachable control interface is a standing invitation to a campaign that can hit thirty targets in a weekend. The operators who sleep well are the ones who can honestly answer one question: “Is any system we control reachable from the open internet — and if I’m not sure, why not?”

If that question makes you uneasy, that uncertainty is the finding. Start there.

See why CPS Secure Remote Access is rated a High-Benefit, Emerging technology in the new Gartner® Hype Cycle™ for CPS Security, 2026 — and how to prioritize it against everything else competing for your CPS security budget. Download the report →