On 26 and 27 July 2026, a coordinated attack hit the operational technology behind more than 30 community water systems in Minnesota. Nine more were hit in Michigan.
The detail that matters most is what the attackers did not do. Forescout's assessment is blunt: they changed IP addresses and set passwords on controllers that were already reachable, causing operators to lose visibility and, in some cases, control — requiring no vulnerability exploit at all.
There was nothing to patch. The devices were simply on the internet, and someone logged in.
What that looked like on the ground
Braham, Plymouth, South St. Paul and Maple Plain publicly described plant outages, communications failures or affected automated controls. Braham's water plant went offline and the city asked residents to minimise water use until treatment resumed.
Across the affected systems the pattern produced boil-water notices and sustained manual operations — staff running a treatment process by hand because the automation had been locked away from them.
Locking an operator out of a PLC is not subtle sabotage. It is closer to changing the locks. The plant still works; the people responsible for it can no longer see or steer it, and the fallback is manual control for as long as it takes to regain access.
Utilities in at least seven states have reported incidents since 27 July. The Hacker News noted Forescout's analysis referenced at least twelve.
The exposure numbers
Two counts were published days apart, using different methods, and it is worth keeping them separate rather than picking whichever is larger.
| Source | Date | Finding |
|---|---|---|
| Forescout | 3 Aug 2026 | 4,407 exposed Rockwell controllers globally, 2,844 in the US |
| Censys | 30 Jul 2026 | 4,148 exposed hosts |
Different methodologies, so they are not directly comparable — but they agree on the order of magnitude, which is the part that should worry anyone.
Of those, 22 exposed controllers sat in cities targeted by the attacks, and 19 of the 22 ran firmware vulnerable to CVE-2017-16740.
The CVE is a distraction
That last figure invites the obvious conclusion, and the obvious conclusion is wrong.
CVE-2017-16740 is a Modbus TCP buffer overflow affecting MicroLogix 1400 Series B and C on firmware 21.002 and earlier, with a CVSS of 8.6. Rockwell fixed it in revision 21.003 — in 2017.
But the attacks did not need it. Forescout's own framing is that firmware updates address specific bugs and do not make direct public exposure of PLCs acceptable. A fully patched controller reachable from the internet with a settable password is still a controller someone else can set a password on.
The nine-year-old CVE is a symptom of the same underlying condition — devices nobody has looked at in a long time — rather than the mechanism of the attack.
For context on device mix: MicroLogix 1400 accounted for 50% of Forescout's findings and the MicroLogix 1100 for 8%.
The cellular modem blind spot
This is the finding with the widest implications, and it explains how a utility can be confident its OT is segmented and still be listed here.
- Over 70% of exposed US controllers are on large mobile carrier networks
- Censys data showed Verizon Business, AT&T Mobility and T-Mobile USA accounted for 59% of exposed EtherNet/IP hosts
- 19 of the 22 controllers in the water-attack cities used the same mobile carrier network
These devices are not behind the corporate firewall because they are not on the corporate network. They reach the internet through a cellular modem — often installed by an integrator for remote support, often undocumented, and invisible to every control that assumes traffic flows through the site's own perimeter.
A network diagram can be accurate and still omit them entirely. Nobody drew the modem because nobody in the room knew it was there.
The protocol detail completes it: EtherNet/IP exposed on port 44818 offers an unauthenticated path that, depending on configuration, lets an attacker identify a controller or write settings to it.
What the agencies have said
CISA urged the water and wastewater sector to protect OT against activity targeting PLCs, in an alert dated 30 July 2026. A separate CISA advisory covers Iranian-affiliated actors exploiting PLCs across US critical infrastructure, and Iranian involvement has been suspected in the Minnesota incidents — suspected, not confirmed, and worth holding loosely.
The FBI and EPA alert of 30 July is the more actionable document. Its recommendations are specifically about the cellular path: strong authentication, updates and logging for cellular modems, with remote access isolated through a private APN, VPN or equivalent.
What to do
- Find the modems first. Inventory every cellular connection at every site, including ones installed by integrators years ago. This is the control that would have prevented these incidents, and it is not a firewall rule.
- Get EtherNet/IP off the public internet. Port 44818 reachable from anywhere is the exposure. Private APN or VPN, not port forwarding with a password.
- Change default and shared credentials on controllers — and record where they are. An attacker setting a password only works where a password could be set remotely.
- Patch anyway, but do not mistake it for the fix. 21.003 has been available since 2017 and would not have stopped this.
- Rehearse manual operation. Several of these utilities ran manually for a sustained period. That is a resilience capability, and it is better practised than discovered.
The uncomfortable general lesson
Most OT security discussion is about sophisticated adversaries and specialised malware. This was neither. It was a scan for reachable controllers, followed by a password change.
The defensive question that follows is not "are we patched" but "what of ours can be reached, by whom, over which path" — and for a large number of organisations the honest answer is that nobody has checked, because the path in question was installed by somebody else and never written down.
