In a span of 48 hours, hackers hit more than 30 water systems across Minnesota, forcing emergency responses and triggering boil-water advisories. The attacks targeted programmable logic controllers (PLCs) — the industrial computers that manage water treatment processes — and in some cases modified passwords to lock out operators entirely. CISA responded with an urgent directive: remove all internet-exposed PLCs immediately.
This is not a hypothetical scenario from a tabletop exercise. This happened in the United States, in 2026, and it represents a pattern that is accelerating across the entire critical infrastructure sector. Water systems, power grids, manufacturing plants, and transportation networks are all increasingly connected to the internet — and increasingly under attack.
The Minnesota Water System Attacks
The attacks on Minnesota water systems followed a predictable but devastating pattern. Threat actors identified PLCs that were directly accessible from the internet — no firewall, no VPN, no authentication beyond default credentials. Once inside, they modified PLC configurations, changed IP addresses to disconnect the devices from their control networks, and altered passwords to prevent operators from regaining access. In some cases, this resulted in boil-water notices and forced facilities to switch to manual operations.
CISA’s advisory noted that threat actors are targeting water entities of all sizes, including organizations with mature cybersecurity processes. The attack vector isn’t always obvious — cellular modems installed by vendors or system integrators may provide undocumented remote access paths that don’t appear in routine attack surface scans. Even organizations that believe their OT systems are isolated may have hidden exposure points.
Why Critical Infrastructure Is Under Attack
Critical infrastructure has become an attractive target for several reasons. First, the impact is immediate and visible — disrupting water service or power generation creates public pressure and media attention, which is often the attacker’s goal. Second, many industrial control systems were designed for reliability, not security. They run decades-old protocols that lack authentication and encryption. Third, the trend toward remote monitoring and internet-connected OT has dramatically expanded the attack surface faster than security teams can keep up.
The ransomware ecosystem has also shifted attention toward critical infrastructure. Of the 2,600+ attack records analyzed by DefendEdge’s threat intelligence platform in recent weeks, ransomware accounts for nearly 2,000 incidents — and the operators targeting critical infrastructure are increasingly sophisticated. Groups like Akira, Qilin, and DragonForce have all been linked to attacks on utilities and manufacturing. These aren’t opportunistic criminals; they’re organized operations with specific sector expertise.
The OT Security Gap
The fundamental problem is that Operational Technology (OT) security has historically been treated as separate from IT security. OT teams focus on uptime and safety — keeping the water flowing, the power on, the production line running. IT security teams focus on data protection and network defense. The two disciplines use different tools, different protocols, and different risk models. When an attack crosses the boundary between IT and OT — as the Minnesota water attacks did — the gaps between these disciplines become the attacker’s advantage.
CISA’s recommendations for the water sector illustrate the scale of the problem: disconnect PLCs from the internet, enable password protection, change default passwords, and allowlist IPs for remote access. These are basic security controls that should have been in place from the start. The fact that CISA had to issue an urgent advisory recommending them in 2026 tells you how far the gap still is.
Securing Critical Infrastructure: A Practical Framework
Identify and Map OT Assets — You cannot protect what you don’t know exists. Conduct a comprehensive inventory of all OT assets, including PLCs, HMIs, sensors, and network connections. Pay special attention to remote access paths — cellular modems, vendor VPNs, and integrator connections that may have been installed without IT oversight.
Remove Internet Exposure — No PLC or OT device should be directly accessible from the internet. Remote access should go through a VPN or gateway device with multi-factor authentication. If a vendor needs access, provide a time-limited, audited connection — not a permanent internet-facing port.
Implement Network Segmentation — Separate OT networks from IT networks using firewalls and VLANs. The Purdue Model provides a proven framework for segmenting industrial control systems. The goal is to ensure that even if IT networks are compromised, attackers cannot pivot to OT systems — and vice versa.
Deploy Continuous Monitoring — OT-specific monitoring tools can detect anomalous behavior on industrial networks — unexpected configuration changes, unusual network traffic patterns, or unauthorized access attempts. These alerts should feed into a 24/7 Security Operations Center that can respond immediately.
Maintain Known-Good Backups — If a PLC’s password is changed by an attacker, you need a known-clean backup of the PLC image to restore operations. Without it, recovery can take days or weeks. Test your backups regularly — a backup you’ve never restored is a hope, not a plan.
Plan for Incident Response — Develop and rehearse OT-specific incident response plans. These plans should account for the unique constraints of industrial environments — safety risks, regulatory requirements, and the need to maintain operations during recovery. Tabletop exercises that involve both IT and OT teams are essential.
The Stakes Are Real
When a corporate network is breached, the damage is measured in dollars and data. When critical infrastructure is breached, the damage is measured in public safety. Boil-water advisories, power outages, and disrupted transportation systems affect entire communities. The Minnesota attacks demonstrated that the threat is not theoretical — it’s here, it’s active, and it will continue to escalate.
DefendEdge’s US-based Security Operations Center provides 24/7 monitoring for both IT and OT environments. Our threat intelligence platform correlates indicators of compromise across millions of data points to detect attacks on critical infrastructure before they cause operational impact. Contact us to learn how we can help secure your operational technology.
Leave a Reply