Water Under Attack: A Decade of Warnings, and the Same Gaps Still Open
Summary: An Iranian national repeatedly accessed the SCADA systems of the Bowman Avenue Dam in Rye, New York, in 2013, viewing water levels and sluice gate status; the DOJ unsealed his indictment in 2016 as the first public charge of a nation-state actor for attacking U.S. water infrastructure. On the weekend of July 26-27, 2026, attackers reached MicroLogix 1100 and 1400 PLCs exposed to the internet through cellular links at more than 30 Minnesota municipal water and wastewater utilities, changing IP addresses and passwords and locking operators out, with the FBI and EPA later confirming similar intrusions in at least seven states.
Key Takeaway: CVE-2021-22681, a CVSS 9.8 authentication bypass, was disclosed in 2021 and added to CISA's Known Exploited Vulnerabilities catalog in March 2026 - and CISA advisory AA26-097A warning of active PLC exploitation by Iran-affiliated actors was updated four days before the Minnesota attacks, which still locked operators out of more than 30 utilities. Dragos data cited here holds that only 3-6% of OT vulnerabilities require immediate action; the sector's problem is knowing which 3-6% before an adversary does.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026