Observed Signal · Aug 26, 2026 · Security Incident · Source: techcrunch · Impact: 4/5 · Sentiment: Negative
CISA: Hackers Hit 100+ U.S. Water Systems in July
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that more than 100 internet-exposed systems in the U.S. water and wastewater sector were targeted by cyberattacks in July. The attacks largely targeted programmable logic controllers (PLCs) from multiple manufacturers — including Rockwell, Schneider Electric, and Siemens — and relied in part on AI tools to produce scripts capable of exploiting vulnerable PLCs. While the intrusions have caused outages and disruptions during investigations, they have had little effect on water supplies. U.S. officials say intelligence points to Iran as the likely actor but have not made a definitive attribution. The incidents raise broader concerns about the cybersecurity and resilience of U.S. critical infrastructure.
Federal agency advisory reveals large-scale, AI-assisted attacks on operational technology in the water sector affecting 100+ systems; significant implications for OT security, incident response, and national critical infrastructure resilience.
Track Schneider Electric Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your Polaris7 workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- CISA observed cyberattacks targeting over 100 internet-exposed systems across the U.S. water and wastewater sector in July.
- Attackers largely targeted programmable logic controllers (PLCs) made by manufacturers including Rockwell, Schneider Electric, and Siemens.
- CISA said the cyberattacks relied in part on AI tools to develop scripts capable of targeting vulnerable Siemens PLCs.
- Intrusions caused outages and disruption as responders investigated, but had little effect on water or wastewater supplies to local communities.
- U.S. intelligence officials say Iran is likely behind the largely opportunistic attacks, though there is no concrete attribution.
Connected Companies & Entities
3 Entities mapped“In recent weeks, hackers have targeted PLCs made by several manufacturers, including Rockwell, Schneider Electric, and more recently, Siemen...”
“In recent weeks, hackers have targeted PLCs made by several manufacturers, including Rockwell, Schneider Electric, and more recently, Siemen...”
“Zack Whittaker is the security editor at TechCrunch.”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
US warns AI-aided hackers target Siemens S7 water systems
U.S. security agencies including CISA, the FBI and the NSA issued an advisory saying hackers are actively exploiting Siemens S7 programmable logic controllers (PLCs) used in critical infrastructure. The agencies warned attackers are using AI to generate exploit scripts that leverage publicly available information to find and compromise out-of-date or poorly secured PLCs, with water supply and wastewater systems across multiple U.S. states already affected. CISA reiterated long-standing guidance to keep such devices disconnected from the internet and cautioned rural communities are often more vulnerable. The advisory follows a series of recent intrusions attributed to suspected Iranian-linked actors targeting U.S. water and energy providers.
US Agencies Warn Iran-Backed Hackers Target Infrastructure
A joint advisory from the FBI, NSA, CISA and the U.S. Department of Energy warns that Iran-backed hackers are increasingly targeting U.S. critical infrastructure. The adversaries have been exploiting internet-facing systems across sectors — including water and wastewater utilities, energy and local government facilities — and specifically targeting programmable logic controllers (PLCs) and SCADA products to manipulate device displays and configuration files. The agencies said the intrusions have caused operational disruption and financial loss. U.S. officials tied the escalation to the broader U.S.-Israel–Iran conflict. The advisory also highlights prior activity attributed to an Iran-linked group called Handala, which has been connected to attacks such as a disruptive breach at medical tech firm Stryker and a leak of partial contents of FBI director Kash Patel’s email account.
Password-Stealing Malware Exposes 1,787 US Water Providers
New research from cybersecurity firm SpyCloud reveals that over a thousand U.S. water and wastewater providers are at risk due to password-stealing malware that compromised employee credentials and session tokens. The firm analyzed over 66,000 public-facing systems registered with the Environmental Protection Agency, identifying 1,787 organizations (nearly 20%) with stolen credentials, and at least 250 with credentials having potential access to operational networks. A case study of an unnamed metering tech provider found one infected device had leaked passwords for 167 utility companies. While this research did not link these exposures to the recent Iran-backed hacks, it underscores the vulnerability of critical infrastructure through infostealer malware and the trade of stolen credentials.
Receive all future signals for Schneider Electric & competitors in your briefing
Never miss material M&A deals, leadership changes, account wins, or product rollouts. Polaris7 monitors 20,000+ primary sources 24/7, delivering verified telemetry directly into your executive briefing.