Protecting Water and Wastewater Infrastructure from Cyber Attacks

Water and Wastewater Treatment Facilities Under Attack

This Is Happening Right Now

On July 30, 2026, the FBI and EPA issued a joint Public Service Announcement warning that malicious cyber actors are attacking internet-facing programmable logic controllers (PLCs) at water and wastewater utilities. Since July 27, 2026, utilities in at least seven states have reported incidents, and some of those attacks degraded water operations.

The details are worth reading closely. Attackers reached Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series PLCs directly over the internet, changed their IP addresses, and set new passwords. Operators lost the ability to see and control their own equipment. Reported effects included loss of water pressure and flooding, and at least one utility discovered modified ladder logic across several sites. Pressure loss is not an inconvenience. It can allow untreated groundwater to seep into distribution pipes.

One more detail deserves attention: the FBI noted that similar network setups installed by third parties across multiple utilities let the attackers multiply their success. A vulnerable cookie-cutter deployment at one site is a vulnerable deployment at every site that integrator touched.

Why Utilities Are Vulnerable

Nation-state groups, criminal organizations, and other malicious actors have learned that water and wastewater utilities are attractive targets. Successful attacks disrupt essential services, threaten public health, and undermine public confidence. Most attacks focus on operational technology (OT), including PLCs, human-machine interfaces (HMIs), remote telemetry units (RTUs), and other control systems that were designed for reliability rather than internet exposure.

Operators in this sector face real challenges in their mission:

A mix of federal, state, local, tribal, and territorial agencies govern many utilities
Population growth can strain current distribution and collection infrastructure
Many OT devices prioritize reliability and availability over modern network protections
Smaller utilities don't have large budgets for security measures or hardware upgrades. In many cases, deployed hardware has reached end-of-life (EOL) status and will never receive another security update. The FBI notes that EOL devices are routinely targeted for exactly this reason.

What the FBI and EPA Recommend

The PSA's guidance is direct, and it echoes earlier federal guidance for the sector:

Disconnect PLCs from the public-facing internet. Remove inbound port exposure entirely, and mediate all remote access through a secure gateway that brokers the connection
Secure cellular modems used for field connectivity with strong authentication, and consider isolated architectures such as private APNs, ZTNA, or site-to-site VPNs
Strictly control network access to PLCs with firewall rules or ACLs that allow only authorized communications between expected control system devices, and block traffic from unauthorized sources such as hosting-provider IP space
Use strong, unique passwords on every device
Block unauthorized changes to logic, configuration, and firmware, and review project files for tampering
Plan for EOL replacement, and where replacement must wait, isolate EOL assets behind compensating controls

Notice what almost every one of these recommendations has in common: they are firewall problems. The attacks in this PSA succeeded because PLCs were directly addressable from the internet. Every mitigation on the list either removes that exposure or controls what can talk to the device once it's removed.

How Netgate Helps Secure Utility Networks

Netgate® appliances running pfSense® Plus software implement these recommendations directly:

End direct internet exposure. A pfSense Plus security gateway in front of a PLC, with default-deny inbound policy and no port forwards, removes the entire attack class described in the PSA. If the PLC is not addressable, it cannot be found, and it cannot be tampered with remotely
Broker all remote access. Instead of an exposed PLC port, remote vendors and staff connect through encrypted VPN (WireGuard, OpenVPN, or IPsec) with per-user credentials, then through a jump host, and only then to control systems. This is exactly the mediated access model the FBI describes. It works over cellular field connections too: a site-to-site tunnel over the cellular link means the modem exposes nothing
Enforce the Access Policy. Put PLCs on their own network segment and write firewall rules that permit only the SCADA server, HMI, and engineering workstation on the specific ports the control protocol requires. Block everything else in both directions. Egress filtering matters here: a PLC has no business initiating connections to the internet, and blocking outbound traffic frustrates the attacker's infrastructure even after a compromise elsewhere.
Enable DNS Filtering and Zero-Trust Egress: Threatgate, a filtering capability built into pfSense Plus can prevent your devices from reaching out to the internet unless the destination is explicitly allowed by policy.
See what's happening. Firewall logs, exported to your syslog server or SIEM, plus Snort version 3 intrusion detection on the OT segment, give you the monitoring and review capability the PSA calls for
Wrap what you can't patch. An EOL PLC that will never see another firmware update can still be defended. Isolating it behind a firewall that admits only enumerated, authorized paths is precisely the compensating control federal guidance prescribes

Utilities can deploy pfSense Plus security gateways at network boundaries to restrict unauthorized communications between operational networks, customer-facing networks, and internet-connected systems. Site-to-site VPNs protect communications between facilities, while our Nexus controller provides centralized management using Zero Trust Network Access (ZTNA). For the multi-site utility, central management answers the PSA's warning about replicated third-party setups: you can see every site's configuration and version state from one place, instead of trusting that each installation is still what the integrator left behind.

before-1

after-1

Each pfSense Plus security gateway comes with the following:

pfSense Plus updates for the life of the product
TAC Lite zero-to-ping technical assistance for the life of the product
Access to no-cost training for pfSense Plus

Certifications available

Network Security That Fits Utility Budgets

The utilities in this PSA were not compromised for lack of a million-dollar security program. They were compromised because control devices sat naked on the internet. Fixing that does not require a rip-and-replace project or a consulting engagement. It requires a capable security gateway at each site, configured once, managed centrally.

Netgate pfSense Plus security gateways are low-cost, in stock, and can ship today! We have a number of pfSense Plus appliances under $1000:

Need help choosing the right appliance for your environment? Contact our sales team for personalized guidance.

Protecting Critical Infrastructure

Water and wastewater operators cannot eliminate every threat, but they can eliminate the one this PSA describes: direct internet exposure of control systems. Limiting exposure, controlling network access, and encrypting remote communications remain the highest-value moves in the sector, and they are the exact moves the FBI and EPA are asking operators to make now. Netgate solutions help utilities implement these recommended practices quickly, economically, and without disrupting critical operations. Our products are trusted worldwide, used by organizations of every size, and deployed across government, education, utilities, healthcare, and enterprise networks.

If your utility has experienced similar OT outages, the FBI asks that you contact your local field office and file a complaint with the IC3 at ic3.gov.

Featured Story

USNS Mercy