Cybersecurity Alert: What We Know About Alleged Iranian Cyberattacks on US Water Utilities

Federal cybersecurity authorities (CISA and the FBI) have released emergency advisories detailing active cyber intrusion attempts against municipal water treatment facilities by state-sponsored cyber actors. The threat groups targeted internet-exposed Programmable Logic Controllers (PLCs) and Supervisory Control and Data Acquisition (SCADA) interfaces operating on unpatched cellular modems with default administrative passwords.

Mandatory Network Segmentation and MFA Mandates

Federal directives mandate immediate network segmentation isolating operational technology (OT) networks from public internet routing and requiring multi-factor authentication for remote access maintenance connections.