The water plant’s ‘remote control’ was hacked across at least seven U.S. states

The FBI and EPA said water and wastewater utilities in at least seven U.S. states reported controller attacks since July 27. Some incidents caused real operational problems, including pressure loss and flooding.

This does not mean drinking water in seven states was contaminated. The July 30 alert did not identify the attacker, say every utility stopped, or report confirmed drinking-water contamination.

What is a water plant’s ‘remote control’?

The targets were small industrial computers that automatically operate equipment such as pumps and valves. Their formal name is programmable logic controller, or PLC.

The FBI observed the activity on Rockwell Automation MicroLogix 1100 and 1400 units. That does not mean every unit of those models, including systems kept off the internet or behind protections, was compromised.

The attackers changed addresses and passwords

Attackers remotely entered controllers reachable from the public internet and changed IP addresses and passwords. Operators could then lose the ability to see or control connected equipment.

One organization also found altered controller project files at several sites. The FBI said similar network setups installed by third parties can let one discovered weakness work across multiple customers.

Why pressure loss and flooding matter

Effects reported to the FBI included loss of pressure and flooding. The outcome depended on what each controller operated and how quickly the utility could switch to manual control.

A large pressure drop can potentially allow untreated groundwater to enter pipes. That is a possible hazard described by the agencies, not confirmation that drinking water was contaminated in these incidents.

Is changing the password enough?

The FBI and EPA put one step first: remove controllers from direct public-internet exposure. When remote access is essential, it should pass through a secure gateway and firewall, with communication limited to approved devices.

Manufacturer Rockwell Automation also tells customers not to expose controllers directly to the public internet. Strong unique passwords, access logs, allow lists and verified backups are additional layers.

The last safety layer is knowing how to run it by hand

Agencies stressed that utilities must be able to keep operating manually when automation fails. Emergency switching procedures, spare systems and backups need regular real-world testing.

The central point is that the attackers did not hack water itself. They hacked the computers that move it, which is why one lost screen can reach pumps, valves and water pressure.

Official primary sources

Primary source: FBI and EPA public service announcement, July 30, 2026

Primary source: Rockwell Automation controller security advisory SD1771

Primary source: EPA, FBI, CISA and NSA joint water-sector advisory