Seven United States federal agencies sign the alert, updated on July 22, 2026, about industrial controllers compromised in water services, energy, and public agencies. The detail that matters to anyone who automates anything is not who carried out the attack. It is the method: access came through equipment reachable from the internet, with the manufacturer’s own engineering software, and the change made to the logic was to turn off the shutdown and alarm routines.

A statement before anything else: this post is an analysis of alerts and primary documentation, not an account of industrial operations. I have never operated a programmable logic controller or a treatment plant. What I follow here is what the official documents state, with the date they were consulted, and the reading I make of them is identified as a reading.

What the documents describe

A programmable logic controller (PLC) is the industrial computer that runs the logic of a machine, a production line, or a water treatment plant. It reads sensors, actuates pumps and valves, and runs a program that someone wrote and loaded. That program lives in a project file.

Two documents from the United States Cybersecurity and Infrastructure Security Agency (CISA) describe what happened to this equipment in recent months.

The first is the notice of July 30, 2026, addressed to the water and wastewater sector. The agency reports a significant increase in attacks on PLCs and asks operators to take exposed controllers off the internet. The intruders changed passwords to lock operators out of their own equipment and changed IP addresses to disconnect it. The result, according to the text, was the issuance of boil-water notices and prolonged manual operation. The notice also observes that exposure often includes cellular modems installed by suppliers or integrators, which may be undocumented and may not be included in routine scans.

The second is the joint alert AA26-097A, published on April 7, 2026 and updated on July 22, signed by the FBI, CISA, the NSA, the EPA, the Department of Energy, Cyber Command, and the Department of the Treasury. It attributes the activity to a group affiliated with Iran and details the technical path. The intruders used rented infrastructure and the manufacturers’ programming software to connect to misconfigured controllers, extracted the equipment’s project files, and returned altered versions.

What those altered versions did is described in so many words, and it is the center of this text. In a free rendering of the alert: the changes “disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies.”

In one of the victims, the FBI observed something even more specific: the malicious project file preserved the logic that kept the process moving forward and added logic that nullified the instructions responsible for keeping the safe operating parameters. The process kept running. Only the protection left.

The entry point was registered

The malicious traffic was observed on four ports: 44818, 2222, 102, and 502. None of them is obscure. All of them are in the public port registry of IANA, the authority that administers these numbers: 502 is Modbus, 102 is the ISO-TSAP used by Siemens equipment, and 2222 and 44818 are the two halves of EtherNet/IP. They are the front doors of industrial automation, documented for decades.

The equipment named as a target is also from an ordinary product line: CompactLogix and Micro850, from Rockwell Automation; Modicon M340, from Schneider Electric; and the S7-1200 series, from Siemens. The alert names them because they were the ones observed, not because they are flawed. Direct exposure to the internet is what opens the door, and that is a decision made by whoever installs the equipment.

It is worth recording the historical counterpoint: these protocols were born for isolated networks, in an era when being physically inside the plant was the authentication. Modbus dates from 1979. CISA describes the consequence of that without hedging in its primary mitigations fact sheet, from May 2025: operational-technology equipment “lacks authentication and authorization methods that withstand modern threats and is quickly found” by scanning for open ports on public IP ranges. And it adds, on the same page, that attackers use tools that are “simple, repeatable, and scalable, available to anyone with an internet browser.”

It is not the first time. In November 2023, a similar campaign compromised at least 75 Unitronics devices, of which at least 34 were in the United States water sector. The alert from that episode records that the devices were on the internet, on the default port, with the default password or with no password at all.

The target was the interlock

Here is the reading that seems to me transferable outside industry.

Serious automation has two layers of logic. One makes the process move: it turns the pump on, opens the valve, advances the conveyor. The other keeps it from moving when it should not — the interlock, the condition that locks the operation when a measurement leaves the safe range, and the alarm that tells the operator that something left it. The first layer is what the system does. The second is what it refuses to do.

The attack described did not steal the process, did not stop production, and did not demand a ransom. It removed the second layer and left the first one running, with the supervisory screens showing reassuring numbers. The system kept obeying. It lost only the ability to disagree.

That reorders the question usually asked about an automation. The usual question is what it can do. The question this case imposes is different: which of its checks can be turned off without anyone noticing? An automation whose check disappears in silence does not become a little less safe. It starts asserting that everything is fine, and that is worse than being stopped.

The same decision, three orders of magnitude down

The consequence of a compromised treatment plant does not compare with that of a home server, and that is not what I am proposing. What repeats is not the severity; it is the three decisions: what stays reachable, with what credential, and what happens when the check disappears.

They show up in full in small-scale automation, and they show up in my own project.

The infrastructure file for this blog’s editorial pipeline does not publish the n8n ports or the database ports on the host. Only the edge proxy listens on 80 and 443, and everything else talks over the internal network. It is the same sentence as the CISA recommendation for the shop floor, written in another vocabulary. It was not virtue: it was reading a document before bringing the service up.

The second decision has also already shown up here, and in an uncomfortable way. The n8n version pinned in that file fell within the range of an unauthenticated file-access flaw, with the maximum severity score. The instance never actually came up, so nothing was exposed, but provisioning with that version would have put a vulnerable service on the internet on the first day. And, while writing about n8n as an MCP server, I found in the official documentation the warning that that node uses no authentication method by default.

The third is the one that interests me most, because it is the one the alert illuminates. The gates that hold publication of this blog have already been inventoried in a full post: what real error each one stopped, and what none of them caught. The industrial case adds a third question, which was not on that list or in my mind when I wrote it. It is not what the gate caught, or what got past it. It is what would happen if the gate were removed.

The content contract brings down the site build when a field leaves the format. It is an interlock. But deleting that check costs one line, and after that the site would keep building, publishing, and looking healthy. No error would appear, because the absence of a check does not generate an error. It is the exact form of the attack described in the alerts: the process continues, the panel reassures, and what left the scene was the ability to refuse.

What can be checked today

Nothing here is my invention. It is the mitigations list from the documents themselves, translated and reduced to what holds at any scale.

  1. Inventory what answers on a public address. Not what you believe you exposed: what answers. The July notice insists on forgotten access points, installed by third parties and absent from the documentation.
  2. Remote access goes through a front door, never straight to the equipment. A virtual private network or a gateway in front, always.
  3. The default password changed, and a list of authorized addresses. Two of the five recommendations in the July notice are exactly that.
  4. A clean backup of the configuration, stored off the equipment. CISA recommends this for the most concrete reason possible: if the intruder changes the password, it is what remains to recover control.
  5. Identify your checks and test whether their absence shows up. If turning the check off produces no error, no alarm, and no log, it is not a protection. It is a suggestion.

It is worth citing the most elementary guidance in the joint alert, because it says a lot about the nature of the problem: on Rockwell equipment, put the controller’s physical key in the run position. The last line of defense in mature industrial automation is a metal key that no network packet turns.

Where this analysis stops

These are documents from the United States, about critical infrastructure there, and they assert nothing about the Brazilian situation. The attribution to a specific group belongs to the agencies, not to me. The manufacturers named appear because they were the ones observed in the campaigns described, and the alerts themselves point to direct exposure to the internet, and not to the products, as the condition that made all of it possible. And I repeat what I opened with: I do not operate industrial equipment. What I bring is a reading of primary documents by someone who automates at another scale.

What remains

The most consequential attack described in these alerts did not need technical genius. It needed reachable equipment, a weak credential, and someone willing to erase the part of the program that existed to say no.

Every automation has that part. Anyone who automates should know how to name it, and should be able to prove that it is still there.

Sources

  • Increase in attacks on PLCs in the water sector, password changes to lock operators out, IP changes, boil-water notices, prolonged manual operation, undocumented modems, and the recommended mitigations — CISA notice of July 30, 2026 (government agency, primary source), verified on 2026-08-17.
  • Use of the manufacturers’ engineering software, extraction and alteration of project files, disabling of shutdown and alarm logic, added logic that nullified the safe operating parameters, ports 44818, 2222, 102, and 502, equipment and manufacturers observed, and the guidance to put the physical key in the run position — joint alert AA26-097A, from the FBI, CISA, the NSA, the EPA, the DOE, the CNMF, and the Treasury, published on April 7, 2026 and updated on July 22, 2026 (primary source), verified on 2026-08-17.
  • At least 75 Unitronics devices compromised, 34 of them in the U.S. water sector, reached on the default port with the default password or with no password — joint alert AA23-335A (primary source), verified on 2026-08-17.
  • Operational-technology equipment without authentication that withstands modern threats, findable by port scanning, and attack tools available to anyone with a browser — CISA primary mitigations fact sheet, published on May 6, 2025 (primary source), verified on 2026-08-17.
  • Ports 502 (Modbus), 102 (ISO-TSAP), 2222, and 44818 (EtherNet/IP) as public registry entries — IANA service names and port numbers registry (registration authority), verified on 2026-08-17.
  • Warning that the MCP Server Trigger node does not use authentication by default — official n8n documentation (primary source), verified on 2026-08-07.
  • Analysis piece: the author works in electric-system operations, including supervisory and control systems, but did not investigate the incidents or the equipment described in the alerts. What is described as the author’s own practice refers to the infrastructure of this blog’s editorial pipeline.