Since July 27, 2026, water and wastewater utilities in at least seven states have reported intrusions to the FBI, a count that reached twelve by August 4. On July 30 the FBI and EPA issued a joint public service announcement describing attacks on internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 controllers, where actors changed IP addresses and set passwords, leaving operators without view or control. Reported effects included loss of pressure and flooding.
The relevant document is older. AA26-097A, a seven-agency advisory on the same campaign, was published April 7, 2026 and last updated July 22 — five days before the water incidents began. Its indicator table lists actor-associated IP addresses going back to September 2025.
No vulnerability was exploited
There is no CVE in this campaign. Per AA26-097A, the actors "used leased, third-party hosted infrastructure and manufacturers' PLC programming software to connect to misconfigured victim PLCs." That is Studio 5000 Logix Designer, EcoStruxure Control Expert, and TIA Portal — the vendors' own engineering tools — reaching controllers that answer on the public internet. Traffic was observed on ports 44818, 2222, 102 and 502, and against modems on port 22, where in one case the actors used Dropbear SSH on the modem itself.
What they did after connecting is the part worth reading twice. They pulled project files off the devices, then modified logic, including Add-On Instructions. The advisory states the changes "disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies." The HMI kept showing normal. The FBI's PSA notes one organization found this only after noticing ladder logic discrepancies across several sites.
So a scanner pointed at that subnet returns zero criticals and is entirely correct. There is nothing to patch and nothing on the operator display to see.
The structural reason these devices sit exposed is more specific than "OT is behind." Censys measured the exposed population on July 30 and found 4,148 internet-facing hosts identifying as Rockwell/Allen-Bradley over EtherNet/IP. Verizon Business, AT&T Mobility and T-Mobile USA together account for 59.0% of them. Nearly six in ten are not on their owner's network at all. They are on a SIM in a field cabinet, installed by an integrator so someone could check a lift station without driving to it, billed to facilities rather than IT, and outside every netblock the organization would think to scan. CISA names this directly: cellular connections installed by operators, vendors or integrators are often undocumented and excluded from routine attack-surface scans.
The practice: enumerate by device and by invoice, not by netblock
External attack surface management assumes you know your address space. For OT that assumption fails, because the exposure is on a carrier's IP range. The enumeration has to come from somewhere else.
Three sources, in order of how much they return per hour spent. First, the cellular bill: pull twelve months of invoices from every carrier the organization pays and reconcile each active SIM or data line against a physical asset. Lines nobody can account for are the finding. Second, the integrator: ask each vendor who has commissioned control equipment for you to list every remote-access path they built, including modems they own and support. Ask in writing, and ask whether the same design was deployed at their other customers — the advisory's own framing of shared setups multiplying successes is what makes that question worth asking. Third, scan the protocols rather than the addresses.
# AA26-097A ports to query in firewall and NetFlow logs
44818/tcp EtherNet/IP explicit messaging (Rockwell)
2222/udp EtherNet/IP implicit messaging
102/tcp S7comm (Siemens)
502/tcp Modbus (Schneider and others)
22/tcp modem SSH - Dropbear observed on victim modems
This costs real time and it is mostly not technical time. Reconciling SIM billing against physical assets is a week of somebody's attention, and the integrator conversation is a procurement conversation that gets uncomfortable when the answer is that nobody documented it. That is the whole reason it does not get done, and it is why scheduling it as a standing quarterly review beats resolving to be more diligent. It is the same failure the notification-timeline cases keep producing in a different domain: at Operation PAR, the thing that took 380 days was not knowing what data was held, and here it is not knowing what devices are reachable.
If a device cannot be pulled off the internet this quarter — and for a remote lift station on cellular, often it cannot — the advisory's fallback is an IP allowlist restricting access to known engineering laptops, plus non-default passwords, plus the physical mode switch in RUN so logic cannot be downloaded remotely. That is weaker than removal and it is a real answer.
Separately, keep known-good copies of project files and diff them. Since the manipulation targets the logic and the displays, integrity checking the program is the detection, not the alerting. This is the same shape as reading a data-plane log to find six days of access an outage report never mentioned: the instrument everyone watches was reporting on something else.
Four checks
- Pull the last twelve months of cellular invoices. Can every active data line be matched to a device and an owner?
- Ask each control-systems integrator, in writing, to list every remote-access path they installed and whether they still hold credentials to it.
- Query firewall and NetFlow logs for inbound traffic on 44818, 2222, 102, 502 and 22, and against the IOC addresses in AA26-097A.
- For each Rockwell controller, confirm the physical mode switch is in RUN, and confirm you hold a known-good copy of the project file to compare against.
Attribution is the agencies' assessment, not a settled fact, and it does not change any of the above. As of August 5, 2026, no affected utility has publicly disclosed how its specific device came to be reachable.
North InfoSec runs AI-assisted penetration testing and security assessments, including external exposure work of the kind described above. northinfosec.com