Historical intelligence backfill. This assessment covers reporting originally published on 2026-07-31 and was added to the RWP archive on 2026-09-07.
FBI/EPA: seven states, internet-facing MicroLogix, changed IPs — some pressure loss and flooding
The 30 July 2026 PSA is the water-sector process event. Nozomi's next-day brief is the operator translation — primitive access, real operational effects, not a 0-day story.
Bottom line up front
CONFIRMED FBI and EPA, 30 July 2026 — since 27 July, water and wastewater utilities in at least seven unnamed states reported incidents. Targets: internet-facing Rockwell/Allen-Bradley MicroLogix 1100 and 1400 (FBI: similar caution for other brands). Method: remote logon, change IP and password, lose monitoring/control. Operational effects reported to FBI include loss of pressure and flooding. FBI notes pressure loss can allow untreated groundwater into pipes. Nozomi 31 July: primitive, not a 0-day; possibly Iranian-affiliated in their assessment, still under investigation in the PSA. NBC: Minnesota had separately reported a coordinated event against 30-plus community systems. This is CONFIRMED OT-impact reporting from USG, unlike the June Handala billing story.
Historical backfill of 31 July 2026 Nozomi/FBI reporting; added 7 September 2026.
What happened
Exposed serial-era PLCs with web/Ethernet cards on the internet. Lock the operator out. Some plants felt it in pressure and flooding. Attribution is not the first control.
Why it mattered
This is the 2023 Aliquippa class of access, scaled across states in days. Small utilities still cannot hide a MicroLogix behind a jump box.
Who / what was affected
WWS in ≥7 states; MicroLogix 1100/1400 named. Minnesota parallel reporting.
Technical context
Remove PLC from internet. Unique passwords. ACLs between expected peers. Manual operations capability. Hunt unexpected IP changes on controllers.
Exploitation / threat status at the time
CONFIRMED USG-reported incidents and some operational degradation.
ASSESSED (Nozomi): Iran-affiliated possible; not FBI's headline.
What defenders should have done
- Shodan yourself before they do.
- If a MicroLogix answers on WAN, that is the incident.
- After lockout: out-of-band, factory-reset procedures, water-quality sampling if pressure dropped.
RWP assessment
Confidence: High. This is the water OT event in the 2026 window.
Defensive actions
- Internet-exposure ticket for every PLC tonight.
- State water-ISAC reporting.
- Do not wait for a CVE.
Sources
- FBI — Malicious cyber actors targeting WWS internet-facing PLCs
- Nozomi Networks — Seven states, one weak spot
- NBC News — Hackers targeted municipal water systems in 7 states