Cyberattacks against U.S. critical infrastructure have moved beyond traditional IT networks and into systems that directly support essential physical services.
In late July 2026, a coordinated wave of cyber activity targeted water and wastewater utilities in at least seven U.S. states, including more than 30 community water systems in Minnesota. Attackers targeted internet-exposed industrial controllers and, in some cases, disrupted monitoring and control functions.
Weeks later, the FBI and U.S. Coast Guard also boarded two U.S.-bound oil tankers after finding indications that foreign cyber actors had compromised their vessel networks. The incidents highlight a common problem across very different sectors: internet-connected operational technology can become a direct pathway to physical infrastructure.
More than 30 Minnesota water systems targeted
The Minnesota campaign took place on July 26 and 27, 2026.
Minnesota IT Services described it as a coordinated cyberattack targeting operational technology at more than 30 community water systems. State officials activated their cyber incident-response capabilities and worked with federal, local and private-sector partners.
The affected technology was used to monitor and control equipment remotely.
In one documented case, the attack temporarily took a city's well and water-treatment plant offline. Other utilities reported disrupted communications with automated equipment and had to switch to manual procedures.
Importantly, Minnesota officials said the attacks did not result in a reported compromise of drinking-water quality, and there were no statewide requests for residents to change their water usage.
That distinction matters. A cyberattack against a water utility does not automatically mean contaminated drinking water or a loss of the water supply. The documented impact varied between affected systems.
The PLC problem
The FBI and Environmental Protection Agency later issued a joint warning describing a broader campaign against water and wastewater utilities.
Since July 27, utilities in at least seven states had reported incidents to the FBI, with some attacks degrading water operations.
The federal advisory identified Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers (PLCs) among the targeted equipment.
PLCs are industrial computers used to control physical processes such as pumps, valves and other equipment.
The attackers gained remote access to internet-facing PLCs and changed configuration information, including:
- IP addresses
- Device passwords
- In some cases, PLC project or control information
These changes could cause operators to lose visibility or control of connected equipment. The FBI reported operational effects including loss of water pressure and flooding in some incidents.
This is significantly different from stealing files from a conventional business network.
An attacker who compromises an internet-facing PLC may be able to interfere with the physical process that the PLC controls.
Why internet exposure is such a serious risk
Many water and wastewater systems were designed around remote management.
Operators and vendors may need remote access to:
- Water towers
- Pump stations
- Treatment facilities
- Wastewater lift stations
- Monitoring systems
- Industrial controllers
The problem arises when those connections are directly exposed to the public internet without sufficient protection.
The FBI and EPA specifically recommend removing PLCs from direct internet exposure and placing remote access behind secure gateways and firewalls. They also recommend strong unique passwords and access-control lists restricting communications to authorized control-system devices.
CISA separately warned that it was seeing a significant increase in threat activity targeting PLCs at water utilities and urged operators to remove publicly exposed operational technology from the internet.
Was Iran responsible?
Attribution remains an important distinction.
U.S. intelligence officials were reported to assess that Iran was likely behind the Minnesota campaign, but Minnesota officials and the FBI's July 30 advisory did not publicly make a definitive attribution to a specific actor.
The FBI advisory itself refers to “malicious cyber actors” rather than naming an Iranian group.
That means the safest description is that the campaign has been linked by some U.S. officials and reporting to Iran, while formal public attribution of the specific Minnesota incidents remained unresolved in the available official advisory.
The technical lesson does not depend on attribution: internet-exposed OT is an immediate security risk regardless of who is behind an intrusion.
The threat extends beyond water
The water attacks were not an isolated example of cyber activity reaching operational technology.
In August, two foreign-flagged tankers travelling toward the United States were subjected to cyber investigations after U.S. authorities detected indications that their networks had been compromised.
The FBI and Coast Guard boarded the vessels in the Gulf of Mexico between August 21 and August 24 to assess their operational and IT systems.
The agencies said the measures were taken after indications that the networks of both vessels had been compromised by foreign cyber actors.
1️⃣ VL Prosperity
One of the vessels was identified by media reports as the VL Prosperity, a Liberian-flagged crude-oil tanker travelling toward Texas.
Reports based on Iranian media accounts alleged that attackers interfered with propulsion, navigation and cargo-related systems and caused a communications outage lasting roughly 30 hours.
However, these operational details have not been publicly confirmed by the U.S. Coast Guard as facts of the incident. The Coast Guard's public statement focused on indications of network compromise and the need to verify the integrity of the vessel's operational and IT systems.
2️⃣ The second vessel
The second vessel was identified in reporting as Kohaku, which was associated with a planned U.S. cargo operation.
Again, U.S. authorities have not publicly attributed the incidents to a particular country or threat group.
Most importantly, the Coast Guard and FBI said there were no reports of operational disruption, vessel instability, danger to crew members or environmental impact from the incidents under investigation.
That makes the tanker incidents serious from a cybersecurity perspective without requiring claims that attackers successfully took control of the ships.
A common weakness: connected operational technology
Water treatment plants and oil tankers appear very different, but from a cybersecurity perspective they share an important characteristic.
Both increasingly depend on connected operational technology.
That can include:
Water utilities
Internet-connected PLCs → remote access → pumps and valves → treatment and distribution
Maritime systems
Networked computers → vessel control systems → propulsion, navigation and cargo operations
When these systems are connected to IT networks, cellular infrastructure, satellite communications or the public internet, cybersecurity becomes part of operational safety.
A compromised account or exposed controller is therefore not simply an IT problem.
It can become an operational problem.
What companies operating critical infrastructure should do
The FBI and EPA recommendations provide a useful baseline for water and wastewater operators.
✅ Remove direct internet exposure
PLCs and other OT devices should not normally be directly reachable from the public internet.
Use controlled remote-access architectures such as:
- Secure gateways
- Jump hosts
- Firewalls
- VPN or ZTNA solutions
- Strict access-control lists
- Segmented OT networks
✅ Audit cellular connections
The FBI specifically warns that cellular modems used for remote field connectivity can become an overlooked access path.
Companies should maintain an accurate inventory of:
- Cellular modems
- Remote-management devices
- PLCs
- Vendor connections
- Internet-facing OT assets
✅ Use unique credentials
Default or reused passwords can turn an exposed industrial controller into an easy target.
Every remotely accessible device should have unique credentials, strong authentication where supported and tightly controlled administrative access.
✅ Monitor configuration changes
Traditional endpoint monitoring is not enough for OT.
Security teams should monitor for unexpected changes to:
- PLC IP addresses
- Passwords
- Ladder logic
- Firmware
- Configuration files
- Remote-access rules
- Cellular connections
✅ Maintain manual operating capability
The Minnesota incidents demonstrate the value of being able to continue operating when digital control systems become unavailable.
Water utilities and other critical infrastructure providers should regularly test whether essential processes can safely continue without remote connectivity.
The bigger picture
The attacks against U.S. water utilities and the investigations involving commercial tankers point to the same underlying cybersecurity challenge: operational technology is increasingly connected, while many systems were never designed to be directly exposed to today's threat environment.
The FBI and EPA have already documented real operational consequences from PLC compromises, including loss of monitoring and control, pressure problems and flooding.
At the same time, the tanker incidents show why maritime cybersecurity is also becoming an operational-security issue rather than simply an IT concern.
For companies operating critical infrastructure, the question is no longer simply:
Is the corporate network secure?
It is also:
Can an attacker reach the systems that control the physical world?
Final thoughts
The recent incidents do not show that U.S. water systems or commercial shipping have been broadly taken offline. Most affected services continued operating, often through manual procedures or other safeguards.
But they demonstrate something more important: attackers are actively reaching operational technology and testing the boundary between digital access and physical infrastructure.
Critical infrastructure must be secured at the operational layer, not just the corporate network. Internet exposure, remote access, legacy controllers and vendor connections all need to be treated as part of the security boundary.
