US authorities said that more than 100 internet-exposed water and wastewater systems were targeted in cyberattacks during July, highlighting a broad weakness in critical infrastructure rather than isolated incidents. The attacks matter because many affected systems use industrial controllers that were not designed to be accessible from the public internet, raising concerns that the activity could be preparation for more disruptive operations.

CISA said attackers commonly targeted programmable logic controllers connected directly to cellular modems, with mostly small rural utilities affected in at least 12 states, including Minnesota, Michigan, Georgia, South Dakota and New Jersey. Analysts suspect Iranian-linked actors, but the US government has not made a formal attribution; CISA urged operators to remove PLCs from direct internet access, use VPNs or gateways for remote connections, protect accounts and replace default passwords.