Nobody has to wait for an attribution ruling to know how badly exposed the water sector already is. This issue shows how to run the same exposure search researchers ran on Minnesota's water towers, using nothing but Shodan and a public IP range.
A federal advisory, a presidential denial, and an unconfirmed intrusion are all sitting on top of the same public data this week, and reading it yourself is faster than waiting for the government to agree with itself.
| 22 Jul | CISA advisory AA26-097A updated: Rockwell code-tampering detection guidance added, scope expanded to Schneider Electric and Siemens | CISA |
| 27 Jul | Hackers begin degrading water utilities in seven US states | Record |
| 30 Jul | FBI and EPA name Rockwell MicroLogix 1100 and 1400 controllers; CISA issues its water-sector alert | FBI/EPA |
| 31 Jul | President rejects the Iran attribution at a Camp David cabinet meeting | Trump |
| 1 Aug | Michigan confirms a second cluster | Michigan |
7 US states affected, two confirmed by name | 5days between the CISA advisory update and the first water utility reports | 30+ Minnesota water systems affected |
Water utilities in seven US states lost control of exposed PLCs starting 27 July
Beginning 27 July 2026, water and wastewater utilities in at least seven US states reported unauthorised access to internet-facing programmable logic controllers to the FBI. The FBI and Environmental Protection Agency named the affected device family as Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series controllers in a joint public service announcement issued 30 July. Minnesota confirmed more than thirty affected water systems, including the city of Plymouth. Michigan's Department of Environment, Great Lakes, and Energy confirmed a second cluster on Saturday, 1 August. The remaining five states have not been named publicly.
| Date | 27 Jul 2026 onward |
| Advisory | FBI/EPA PSA, 30 Jul 2026 |
| Device | Rockwell MicroLogix 1100/1400 |
The exposure was flagged before this specific wave began. CISA's joint advisory on Iranian-affiliated PLC exploitation (AA26-097A), originally published April 2026, was updated 22 July 2026 to add Rockwell Automation code-tampering detection guidance and expand its scope to Schneider Electric and Siemens devices, five days before the first water utility reports came in. CISA's water-sector alert, issued 30 July, made the blind spot explicit: even utilities with mature cybersecurity processes need to validate their external connections, since the activity includes cellular modems installed by operators, vendors, or integrators that often go undocumented and fall outside routine attack-surface scans.
A practitioner reading that update, or running the same class of Shodan and Censys queries it implies, would have known the device class and its exposure pattern five days before this specific wave began. That does not mean this exact intrusion was predictable. It means the technical signal for what was about to be exploited was already public, dated, and government-sourced when it happened. Section 02 walks through the search itself, and the case of a Minnesota utility where it was run after the fact.
Run a Shodan or Censys search for Allen-Bradley or Rockwell on ports 44818, 502, 102, and 2222, scoped to any client or state IP range you cover. Cross-reference every hit against the advisory's named device models. Note the scan date; treat anything older than a few weeks as needing confirmation. Do this before assuming an advisory means someone already checked.
This is not a story about Iran. It is a story about how much operational technology sits on the public internet in plain sight, indexed and searchable months before anyone with hostile intent has to try. The attribution fight tells a practitioner nothing about the exposure itself. The exposure was never secret.