Water and wastewater utilities in at least 12 states have now reported cyberattacks on their operational systems, in a coordinated campaign that U.S. intelligence sources believe is linked to Iran. The attacks began the week of July 27, 2026, and they have already reached Georgia — a metro Atlanta water authority serving roughly 300,000 customers issued a boil water advisory after a pump station failure, and is now investigating unauthorized cyber activity that it says may have caused or contributed to it.

This is not a hypothetical threat brief. This is happening right now, in this state, to organizations that look a great deal like yours.

Below is what actually happened, how the attacks work at a technical level, and — more importantly — the seven layers of defense that stop this class of attack. Those layers are not exotic. They are the same layers that protect an accounting firm in Buford or a medical practice in Gainesville. That is the part most of the coverage is missing, and it is the part that should concern every business owner reading this.

What happened in Georgia

At approximately 1:00 a.m. on July 27, a pump station at the Clayton County Water Authority failed. Customers in parts of north Clayton County experienced low water pressure, and some lost water entirely. Crews restored pressure by around 4:00 a.m., and the precautionary boil water advisory was lifted on July 28 after testing confirmed the water was safe.

At the time, it looked like an equipment failure.

On August 4, CCWA said it was investigating “unauthorized cyber activity that may have caused or contributed to” the disruption, noting that utilities nationwide are facing a growing number of cyber threats targeting critical infrastructure. The focus of that investigation is programmable logic controllers — the small industrial computers that operate pumps, valves, and chemical treatment across a water system.

A second Georgia water authority reported a cyber incident the same day.

Two things about the Clayton County incident deserve emphasis:

1. Loss of pressure is not a nuisance — it is a public health event. When pressure drops in a distribution system, untreated groundwater can be drawn into the pipes through joints and cracks. That is precisely why a boil water advisory gets issued. The attackers did not need to touch a chemical dosing setpoint to create a health risk. They only needed to stop a pump.
2. Seven days passed between the outage and any public connection to cyber activity. From July 27 to August 4, this looked like mechanical failure. To be fair to CCWA, that is not evidence of a slow response — a federal advisory published on July 30 told the entire sector what to look for, and the investigation is still open. But it illustrates the thing that should worry every operator and every business owner: an outage and a compromise can look identical from the outside. We will come back to that.

CCWA has confirmed that customer billing and payment data was not accessed.

The national picture

The Georgia incidents are part of a much larger wave.

Date	Event
April 7, 2026	CISA publishes advisory AA26-097A, documenting Iranian-affiliated actors exploiting internet-exposed Rockwell Automation/Allen-Bradley PLCs across government services, water, and energy sectors.
June 2026	The Iran-linked group Handala claims credit for a breach at California Water Service.
July 22–23, 2026	CISA, the FBI, the NSA and the Department of Energy update AA26-097A — expanding the scope to Schneider Electric and Siemens controllers, documenting PLC project file theft for the first time, and adding detection guidance for tampered code modules.
July 26–27, 2026	A coordinated attack disrupts water and wastewater systems across more than 30 Minnesota communities.
July 27, 2026	Clayton County Water Authority pump station failure; boil water advisory issued in metro Atlanta.
July 30, 2026	CISA issues a follow-up advisory.
Aug 1–5, 2026	The FBI confirms incidents in at least seven states; reporting expands the count to at least 12 states, including Minnesota, Michigan, Georgia, South Dakota, and New Jersey.

The federal government has not made a formal public attribution. But multiple outlets — including NBC News, CBS News and Bloomberg — report that sources familiar with the investigations point to Iran, which has repeatedly targeted this specific class of operational technology since 2023. The tradecraft is consistent with CyberAv3ngers, a persona associated with the IRGC Cyber-Electronic Command.

Federal authorities have reported loss of monitoring and control functionality, along with pressure loss and flooding, at affected sites. To date there have been no reports of illness and no widespread disruption to water supplies.

How these attacks actually work

This is the part that should change how you think about your own network, because the technique is unglamorous to the point of being insulting.

The attackers are not breaking in. They are logging in.

Step 1: Find devices exposed to the open internet

Water systems run on PLCs. Those PLCs are frequently connected to the internet directly — through a misconfigured management interface, or through a consumer-grade cellular modem at a remote well site or lift station — so that an operator can check on them from home at 2:00 a.m. instead of driving out.

Anyone can find these devices. They answer on well-known industrial ports: 44818 (EtherNet/IP), 102 (S7comm), 502 (Modbus), and 22/2222 for SSH. Scanning the entire internet for them takes minutes.

Joshua Corman of the Institute for Security and Technology put it bluntly to CBS News: many of these systems were “directly on the internet with no firewalls or VPNs or anything, with no passwords set in most cases.” His summary of the state of the sector — “the bottom line is there’s no one guarding these systems” — is the most quotable line to come out of this campaign, and unfortunately the most accurate.

Step 2: Authenticate with nothing

Default credentials. Blank credentials. Vendor-documented credentials that have been public for a decade. In some cases, authentication bypass via CVE-2021-22681, a CVSS 9.8 flaw in Rockwell Logix controllers stemming from an insufficiently protected cryptographic key. That vulnerability was disclosed in February 2021 and has no vendor patch — it can only be mitigated architecturally, by not letting the attacker reach the device in the first place.

Other vulnerabilities in play include CVE-2023-3595 (ControlLogix 1756 remote code execution via CIP messages, CVSS 9.8) and CVE-2024-6242 (ControlLogix Trusted Slot bypass, CVSS 8.4).

Step 3: Take the operator out of the loop

Once in, the pattern is consistent and deliberate:

• Change the device password, locking the legitimate operator out
• Modify the IP configuration, disconnecting the PLC from the utility’s own monitoring
• Disable alarms and safety shutdown logic while leaving the visible ladder logic looking normal
• Deploy Dropbear SSH on the victim’s cellular modem for persistent access
• Exfiltrate PLC project files using legitimate vendor engineering software running on third-party hosted infrastructure

That third bullet is the one that should raise the hair on your neck. CISA’s July update specifically flags manipulation of Add-On Instructions — reusable code modules embedded in PLC programs. An attacker who edits an AOI can disable the safety interlocks that are supposed to shut a process down when it goes out of range, while the program on the screen still looks correct to the engineer reading it.

The system operates unsafely, and nobody is told.

Step 4: Wait

Which brings us back to the week that passed before a pump failure in Georgia was publicly connected to cyber activity. When you remove monitoring, disable alarms and take a copy of the project file, you are not just causing an outage — you are buying time, and you are taking a blueprint. CISA documented project file exfiltration for the first time in the July update. Those files describe exactly how a treatment process is built and controlled.

CISA has not stated why the files were taken. The obvious reading is that a stolen blueprint is useful for a second visit.

Why water utilities are such easy targets — and why that should worry every business

Michael Garcia of the Operational Technology Cybersecurity Coalition described water utilities as “low-hanging fruit.” He is right, and the reasons are worth listing, because you should read this list twice — once thinking about a water plant, and once thinking about your own company.

• No dedicated security staff. The EPA counts more than 44,000 community water systems in the United States (and over 148,000 public water systems of all types). The overwhelming majority are small municipal operations. The smallest confirmed victim in this campaign, Braham, Minnesota, serves about 1,700 residents. Braham does not have a security operations center. Neither does the average 40-person business.
• Flat networks. The business network and the control network are frequently the same network. A phishing email opened in the front office reaches the pumps.
• Industrial equipment stays in service for decades. You do not rip out a functioning controller because a CVE was published. So the vulnerable device stays — CVE-2021-22681 was disclosed in February 2021 and was still being exploited in the field this year.
• Remote access built for convenience, not security. A cellular modem at an unmanned site with a public IP is a permanent open door.
• Nobody watching overnight. The Clayton County pump station failed at 1:00 a.m. Ask yourself honestly: if something in your environment were quietly compromised at 1:00 a.m. on a Tuesday, who would see it?
• No mandatory reporting. Because federal disclosure requirements do not exist for this sector, the true scope of the campaign is unknown. The 12-state figure is a floor, not a ceiling.

Now re-read that list as a description of a typical Georgia small business. The vulnerability profile is nearly identical. The only difference is what an attacker chooses to do once they are in.

The seven layers that stop this

First, an honest statement that most vendor write-ups of this campaign will not make.

This attack came in through exposed industrial controllers, not through email. At Clayton County and at Braham, the entry point was a device answering on the public internet with credentials that were default, weak or absent. Layers 1, 6 and 7 below — get it off the internet, fix the credentials, keep offline backups — are the controls that speak directly to that attack. An endpoint antivirus agent and an email filter would not have stopped it, and any company telling you otherwise is selling you something.

So why the other four layers?

Because the version of this attack that reaches your business does not arrive through a pump station. It arrives through an inbox, or an exposed remote-desktop port, or a contractor’s laptop. Same failures, different front door, and a different goal at the end — ransomware and wire fraud rather than water pressure. The seven layers below are built to break the whole chain from first access to final impact, whichever door it comes through. That is why an ordinary business needs all seven and a water plant needs all seven, for partly different reasons.

Two things sit underneath the entire stack and are not really layers at all: patching and vulnerability management on the endpoints and engineering workstations that form the other half of the attack surface, and security awareness training for the people who open the messages. Skip either and everything below is compensating for a hole you chose to leave open.

We deploy this stack every day as part of our cybersecurity and compliance practice, and the principle behind it is one we have written about for years: a layered cyber defense that works for small business. No single product on this list saves you. The overlap does.

Layer 1: Get operational technology off the public internet, behind a firewall running in active blocking mode

CISA’s guidance is unambiguous. The acting director’s words: “We urge critical infrastructure owners and operators to remove publicly exposed PLCs and other operational technology from the internet as soon as possible.”

But “remove it from the internet” is only half an answer, because operators still need remote access to do their jobs. The right architecture is a next-generation firewall deployed inline, in active blocking mode — not passive monitoring mode — with the full security services subscription enabled and actually turned on.

That distinction matters more than anything else in this article. We regularly inspect firewalls at prospective clients and find capable hardware sitting in a posture where it logs threats instead of stopping them, or with the licensed security services expired, or with the subscription active but half the inspection engines never switched on. The organization believes it is protected. It owns a very expensive router.

Deployed correctly, this layer gives you:

• Intrusion prevention that drops known exploit traffic — including the CIP and S7comm attacks used here — before it reaches a controller
• Geolocation and reputation blocking to refuse connections from hosting providers and countries with no legitimate business reason to reach your equipment
• Deep inspection of encrypted traffic, because attackers stopped using cleartext years ago
• Enforced network segmentation between the business LAN and the control network, so an infected front-office PC cannot pivot to a pump
• A proper remote-access tunnel with multifactor authentication, replacing the exposed cellular modem entirely

There is also a physical control worth stating plainly for utility operators: set the PLC mode switch to RUN. It prevents remote logic modification — the Add-On Instruction tampering described in Step 3 — and it costs nothing. Be clear about what it does not do: it will not stop a password change, an IP reconfiguration, SSH persistence on a modem, or project file theft. It is one control in a chain, which is exactly why it has to be paired with the network-level controls above.

One caveat on the intrusion prevention bullet, because it is the kind of detail that separates a real deployment from a brochure: inspection of industrial protocols like CIP, S7comm and Modbus is not universal across firewall platforms and is rarely on by default. It generally requires a specific industrial-protocol inspection capability, licensed and enabled. A firewall that inspects HTTP beautifully and passes CIP untouched has not protected the controller. Ask the question explicitly before you assume you are covered.

Layer 2: Next-generation antivirus on every endpoint

Traditional signature-based antivirus compares files against a list of known bad things. That model failed years ago and it fails completely against this campaign, where much of the malicious activity uses legitimate vendor engineering software — Studio 5000, TIA Portal, EcoStruxure Control Expert — running on infrastructure the attacker rents. There is no malicious file to detect. The tool is legitimate. The behavior is not.

What is required is next-generation antivirus that models behavior rather than matching signatures — technology that recognizes an engineering workstation suddenly reading and transmitting project files at 2:00 a.m., or a process spawning a chain no legitimate workflow produces, and kills it based on what it is doing rather than what it is named.

Applied to a normal business, the same engine is what stops ransomware in the seconds between execution and encryption, and what catches the credential-stealing tool that has never been seen before and therefore appears on no blocklist anywhere in the world. This is what our endpoint protection service is built on, and it is also the specific control most cyber insurers now ask about by name — see what cyber insurance actually requires in 2026.

Layer 3: Real email security behind Microsoft 365

Microsoft 365 includes email filtering. It is not sufficient, and every managed service provider who has cleaned up a business email compromise knows it.

The gap is specific and it is exploitable. Native filtering evaluates a message primarily at the moment of delivery. Attackers have industrialized the workaround: send a clean message containing a link to a page that is benign at delivery time, then weaponize that page an hour later, after the message has already passed inspection and is sitting in the inbox. The filter has moved on. The user clicks at 9:15 a.m. on a link that was safe at 3:00 a.m.

What closes that gap is a dedicated email security layer that integrates with Microsoft 365 through the API and sits behind the native filtering, providing:

• Detonation of every attachment and every link in an isolated sandbox before the user can reach it, not just a reputation lookup
• Continuous scanning that keeps working after the message lands, so a link that turns malicious later is caught and the message is pulled back out of the mailbox — the single most valuable capability in the entire category
• Detection of credential-harvesting pages that impersonate the Microsoft 365 login screen, which is how the majority of business email compromise actually begins
• Impersonation and business-email-compromise detection on messages that contain no attachment and no link at all — the wire transfer request that is pure text and passes every technical check
• A route to a human analyst when something is ambiguous, instead of a queue nobody reviews

For a utility, this is how the front office stops being the way in. For every other business, this is the control that most directly prevents the wire fraud and ransomware events that actually put companies out of business.

Three things worth reading if this layer is where you feel exposed: why it is so difficult to detect phishing emails, when MFA isn’t enough — the Microsoft 365 account takeover attack, and, if you think it may already have happened, your business has been phished — now what. Filtering is only half the answer; the other half is the people clicking, which is why we treat human risk management as its own layer and why ongoing training beats one-time training every time.

Layer 4: Post-compromise detection, in real time

Every layer above is what the industry calls left of boom — work done before the incident, to prevent it.

Mature security programs accept an uncomfortable premise: assume some of it will fail. A contractor plugs in an infected laptop. A zero-day lands. Someone’s password was reused on a site that got breached in 2023. What matters then is the distance between compromise and detection.

In Georgia, seven days passed between the outage and the first public connection to cyber activity — and it took a federal advisory telling the whole sector what to look for. That is not a criticism of one utility. It is the normal state of affairs almost everywhere, including in your building.

The layer that closes that gap is continuous detection of what happens after initial access, correlated across endpoints, identity, network and cloud, and evaluated in real time rather than reviewed in a weekly report. Its job is to catch the things that only look wrong in sequence:

• A PLC or server whose configuration changed outside any maintenance window
• Credentials authenticating from a country where you have no employees
• Lateral movement between segments that have no business talking to each other
• Alarm or logging functions being disabled — the exact behavior CISA flagged in the AOI tampering
• A new persistence mechanism appearing on a device that has not changed in three years

For a business rather than a plant, the same layer is what catches credential stuffing from a country you do not operate in, lateral movement from one infected PC to the file server, or a privilege escalation on your domain controller — the exact sequence that turns one phishing click into a company-wide ransomware event.

The measurement that matters is dwell time: how long an intruder is inside before anyone notices. The objective is minutes. If you cannot say what yours would be, it is longer than you think.

Layer 5: A nightly vigilance team

Every technical control above generates alerts. Alerts that nobody reads are a liability, not a defense — they create a paper trail proving you were told and did nothing.

The Clayton County pump station failed at 1:00 a.m. The Minnesota attacks landed overnight on July 26-27. This is not a coincidence and it is not sophisticated: attackers work when defenders sleep, because that is when the response window is longest.

A nightly vigilance team — real analysts watching your environment through the overnight hours, every night — is what converts detection into response. Their function is narrow and non-negotiable:

• Triage alerts as they fire, separating the genuine from the noise
• Contain immediately — isolate the endpoint, disable the account, block the address — without waiting for business hours
• Escalate to a human who can make decisions, by phone, at 2:00 a.m., because that is when it matters
• Correlate across clients, so an attack pattern seen at one organization at midnight becomes a protection applied to every other organization before dawn

That last point is why this campaign is being contained at all. Utilities are finding these intrusions because CISA published detection guidance and the community shared indicators. The same principle applies at the scale of a managed service provider — what we see at one client at 1:00 a.m. protects every other client by morning.

Twenty-four hours a day is not a marketing phrase. It is a schedule with names on it — ours are on our cybersecurity team page.

Layer 6: Credentials, multifactor authentication, and segmentation

The unglamorous controls that would have prevented most of this outright:

• Change every default password. On PLCs, on modems, on cameras, on switches, on the NAS, on the door controller.
• Unique credentials per device. One shared password across a fleet means one compromise is a total compromise.
• Multifactor authentication on every remote access path and every administrative account, with no exceptions. The exception is where the breach comes from.
• Segment IT from OT — and in a normal business, segment users from servers, guests from everything, and any device you cannot patch into an isolated network of its own.
• Audit what is actually reachable from outside. Not what the network diagram says. What responds to a scan today.

Layer 7: Offline backups — including your configurations

For utilities: back up all PLC logic and configuration offline, on secured physical media. If an attacker changes a password and an IP configuration and you have no known-good copy of the program, you are rebuilding a treatment process from memory during an outage.

For every business: the same principle, applied to servers, firewall configurations, line-of-business databases, and Microsoft 365 data — which Microsoft does not back up for you in the way most owners assume. Backups connected to the network are ransomware targets, not backups. And an untested backup is a hypothesis, not a recovery plan. Test the restore quarterly. Time it. The number you get is your real downtime. If you have never mapped that number against what the outage would actually cost, start with backups, disaster recovery, or a business continuity plan — which one comes out on top.

A checklist for Georgia water and wastewater operators

If you operate a water or wastewater system in Georgia, this is the short list, in priority order:

1. Inventory every device with a public IP address. Include remote sites, wells, lift stations and towers. Include cellular modems.
2. Disconnect internet-exposed PLCs and HMIs today. There is no patch for CVE-2021-22681. Architecture is the only mitigation.
3. Set physical PLC mode switches to RUN.
4. Change all default and shared credentials on controllers, modems and engineering workstations.
5. Replace consumer cellular modems with industrial VPN gateways requiring multifactor authentication.
6. Deploy a next-generation firewall inline in active blocking mode, with full security services enabled, enforcing IT/OT segmentation.
7. Review AA26-097A and ingest the published STIX-format indicators. Monitor ports 44818, 102, 502, 22 and 2222 for connections from foreign hosting providers.
8. Audit PLC project files for modifications outside maintenance windows — specifically Add-On Instructions and any change touching alarm or shutdown logic.
9. Back up all PLC logic and configuration offline.
10. Arrange overnight monitoring. These attacks happen at 1:00 a.m.

If you cannot complete this list with the staff you have, that is the normal answer, not an embarrassing one. It is the reason organizations like ours exist.

This is not really a water utility story

Here is the part we want to leave you with, because it is the part that applies to almost everyone reading this.

Southeastern Technical does not primarily serve water utilities. We serve medical practices, accounting and professional firms, engineering companies, manufacturers, contractors and distributors across Georgia — ordinary businesses, doing ordinary work, on ordinary Tuesdays. That is what our managed IT and IT support work looks like on a normal day.

And every single failure that let Iranian-linked actors into a water plant this month is a failure we find during assessments at ordinary businesses:

At the water plant	At a normal business
PLC exposed to the internet with no password	RDP or a management interface exposed with a weak password
Firewall absent, or present and not actually inspecting	Firewall present, subscription lapsed, running in monitor mode
Signature antivirus that misses legitimate-tool abuse	Signature antivirus that misses the ransomware loader
Front office flat with the control network	Everything flat — one VLAN, one broadcast domain, no segmentation
Email is the way in to the business side	Email is the way in — consistently one of the primary initial-access vectors
Seven days before the outage was publicly linked to cyber activity	Compromise often found only when a customer, a bank or a regulator tells you
Attack lands at 1:00 a.m., nobody watching	Attack lands at 1:00 a.m., nobody watching

The attackers scanning for exposed water controllers are running the same scans against every other IP address in Georgia. They are not curating a target list of critical infrastructure. They are taking whatever answers the phone — and the small business is the one that never had anyone guarding the systems.

Substitute ransomware on your file server for pressure loss in a distribution main, and the story is identical: a device that should never have been reachable, a credential that should have been changed, an alert nobody saw at 1:00 a.m., and a week of not knowing. The difference is that a utility’s bad day makes the news and yours does not — you simply absorb it. If you have never put a number on that, our data breach cost estimator is a sobering ten minutes.

The seven layers above do not care what industry you are in. A firewall running inline in active blocking mode with its full security subscription enabled protects a pump station and a dental practice equally well. Behavior-based next-generation antivirus stops the abuse of legitimate tools whether the tool is industrial engineering software or PowerShell. Email security layered behind Microsoft 365 that can still pull a message back after delivery stops the phishing attempt that starts the whole chain, in a utility’s front office or an accounting firm’s inbox on April 12th. Real-time post-compromise detection and a nightly vigilance team close the gap between breached and knowing you were breached — and that gap, not the initial intrusion, is what determines whether an incident is an inconvenience or an existential event.

The water utilities in twelve states did not get attacked because water is special. They got attacked because they were reachable and unwatched.

Ask yourself the only question that matters: right now, at 1:00 a.m. tonight, who is watching yours?

---

Talk to us before you need to

If you operate a water or wastewater system in Georgia, or if reading the checklist above made you uncomfortable about your own network, our business IT assessment will tell you exactly what is exposed, what is missing, and what to fix first — in priority order, in plain language, with no obligation. Healthcare organizations should start with the healthcare IT assessment instead, which adds the HIPAA-specific checks.

We are based in Buford and we work across Georgia. We have been doing this for a long time, and we run the same stack on our own network that we deploy on yours.

Contact Southeastern Technical — or call, and ask for the assessment.

---

Sources

1. Cyberattacks on water systems expand to 12 states as South Dakota, Georgia announce incidents — The Record / Recorded Future News
2. Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A) — CISA
3. America’s water systems are getting hacked amid security gaps: “No one guarding these systems” — CBS News
4. Coordinated Cyberattack on Minnesota Water Utilities: What You Need to Know — Tenable
5. Iran likely behind cyberattacks on U.S. water systems, sources say — NBC News
6. US government says Iran-linked hackers are disrupting American water and energy providers — TechCrunch
7. CISA, FBI warn that Iran-linked hackers are expanding target set for water, energy — Cybersecurity Dive
8. Metro Atlanta water system hit by cyberattack possibly linked to Iran — Atlanta Journal-Constitution
9. Expert says Georgia water system attack highlights critical security deficiencies — Georgia Recorder
10. Water system cyberattacks spread to Georgia, Michigan amid US-Iran conflict — The Register
11. Clayton County Water Authority probes cyberattack amid U.S.-wide warnings — 11Alive
12. The number of states targeted in cyberattacks on water systems has jumped to 12 — Axios