What makes these community water and wastewater systems vulnerable?

U.S. water and wastewater systems are vulnerable because many industrial controllers were never designed to be exposed to the public internet. In practice, however, too many PLCs and other OT devices are reachable online, protected by weak or default passwords, and connected to business networks with little segmentation. Hidden access paths, including undocumented cellular modems, can make exposure even harder to detect

The risk is amplified by the structure of the sector. There are roughly 150,000 to 170,000 water systems in the United States, most of them small or rural, with limited cybersecurity staff and constrained budgets. Many are focused first on compliance and day-to-day operations, leaving basic cyber hygiene underdeveloped.

Recent federal alerts show how attackers are taking advantage of these gaps. In some incidents, threat actors accessed internet-facing PLCs, changed passwords and IP addresses, and locked operators out of their own systems. EPA inspections have also found that more than 70% of inspected systems since September 2023 violated basic cybersecurity requirements, including failures to change default passwords and complete required risk assessments.

Quote from 2024 – “The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency, EPA, and other federal entities have issued numerous advisories for cyberattacks against information networks and process control systems at water and wastewater systems by malicious cyber actors, including the Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated cyber actors, Pro-Russia Hacktivists and the People’s Republic of China (PRC) state-sponsored cyber actors (known as Volt Typhoon, Vanguard Panda and other names). These malicious cyber actors have disrupted some water systems with cyberattacks and may have embedded the capability to disable them in the future.”

In short, the sector’s vulnerability comes from a dangerous mix of legacy equipment, public internet exposure, weak access controls, and under-resourced operations. The fastest mitigation is to remove PLCs from direct internet access and route remote access through secure gateways, VPNs, and allowlists.

Note: An allowlist is a list of domains explicitly permitted to bypass DNS filtering rules. Allowlists ensure that critical services, trusted websites, and approved resources are never blocked — even when broad category filters are enabled. In an  OT/network security system,  an allowlist more commonly means an explicit list of permitted IP addresses, devices, or source networks that are authorized to communicate with the controllers.

Things you can due to prepare.

1. 1. Maintain  a stock pile of bottled water and perhaps some emergency water filters and disinfection tablets. This is one reason we work on projects that develop local spring water sources of bottled water.  These become great resources during an emergency and most of the operational permits issued by the state require the water to be used for "emergency" purposes.   We have gone one step further, we installed a series of rain water collection systems. 
      
      
   2.  Purchase a Solid Go Bag, emergency radio, and an emergency generator.  If you have the budget, you might want to consider a mobile off the grid water treatment system. 
      
      
   3. Update the software on your cellphone and home computer and consider installing a VPN (US Based).
      
      
   4. Updated all Passwords on your cameras, security systems, phones, computers, and credit cards and perhaps get a small fireproof safe to store some cash.  
      
      
   5. Remove your information from databases.  We recommend Incogni. This is a service we use. 
      
      
   6. Join or sign up for your state and local community and utility emergency notification services. 

Other Articles - Cyberattacks

Article 1: How and Why Are Hackers Targeting U.S. Public Water Systems?

Article 2:  Why Are Water and Wastewater Systems in Minnesota and Michigan Being Targeted by Cyberattacks?

Citation's / Sources

Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions

CISA warns of cyberattacks disrupting U.S. water utilities

Enforcement Alert: Drinking Water Systems to Address Cybersecurity Vulnerabilities

Get an In-Home DIY Water Screening Test

Safe Home Water Testing Kit — This water testing kit has everything you need to test your water at home! Includes 14 different tests.

The Know Your H20 Team partners with the Keystone Clean Water Team .  The Keystone Clean Water Team is a (501 c3) that focuses on Pennsylvania, but helps private well owners and small water systems worldwide. For more information about us, please visit our portal.  We have a new educational booklet on drinking water quality "Our Drinking Water".    

More Questions -visit us at KnowYourH20.com

If you can – give us a hand – all we ask, is you share, retweet, and help promote our social media platforms. If you can donate – GREAT ! Buying your testing supplies via our shop is another option to help this mission.

Affiliate Disclosure: This article contains affiliate links. If you purchase a product through one of these links, we may earn a small commission at no additional cost to you. We only recommend products we believe in. This helps support our mission to educate consumers about water quality.