Water Utility Attacks Are a Reminder to Inventory Cellular Modems

The detail I keep coming back to is the inventory. You cannot secure, patch, or monitor a connection the utility does not know exists.

CBS News reported malicious activity affecting water systems in at least seven states, including more than thirty community water systems in Minnesota. CISA's July 30 advisory highlighted a problem that belongs in the wireless conversation: cellular modems installed by operators, vendors, or system integrators may be missing from asset inventories and routine attack-surface scans.

What happened

CISA said threat actors targeted publicly exposed programmable logic controllers, modified passwords to lock out operators, and changed IP addresses to disconnect the controllers. The resulting disruptions included boil-water notices and sustained manual operations.

Some of that exposure ran through cellular connections. A cellular modem does not automatically make a device public, but a publicly routable address without a firewall, gateway, or restrictive access-control list can put the equipment within reach of internet scanning. Service banners and open ports may reveal enough about a device to make it a target.

CISA told operators to disconnect PLCs from direct internet exposure, send necessary remote access through a VPN or gateway, change default passwords, allowlist trusted source IPs, and keep a known-clean PLC image. The advisory also directed MicroLogix 1400 operators to Rockwell Automation's password-recovery guidance.

Why the label can distract from the fix

Calling this a hack raises awareness, but it can also make the activity sound more exotic than the published evidence suggests. The operational lesson is simpler: direct internet exposure gave attackers a path in, and CISA warned that some cellular connections may be missing from inventories and attack-surface scans.

This isn't necessarily a hack. This is laziness.

Defenders can use services such as Shodan and Censys to see what their address space reveals to an outside scanner. That is a discovery step, not a security control. Removing a result from a search index does not close a port, change a password, or place a PLC behind a gateway.

A public address is not proof that a device is vulnerable, and a cellular connection is not automatically unsafe. The risk appears when direct reachability, weak access controls, and incomplete ownership records meet.

Start with the carrier inventory

A normal network scan may not find a modem billed and managed through somebody else's carrier account. Pull the active SIM list from the carrier portal, record each assigned address and service, and identify who owns the account. In municipal systems, that may be the integrator rather than the utility.

Cross-reference the carrier list with drawings, maintenance records, and accounting. A recurring charge for a static address can point to a connection that never made it into the network inventory. "Devices you can't see are devices nobody has patched."

For connections that must remain available, remove direct reachability. A private APN, carrier NAT, IPsec tunnel, firewall, or secure gateway can narrow the path to authorized systems. Disable unused radios, and move vendor support behind a broker or jump host instead of leaving a management port exposed.

Then compare the running PLC project with a known-good baseline, review ladder logic and add-on instructions, rotate PLC and HMI credentials, validate backups before restoring, and log connections through the cellular gateway.

This is not only a small-town problem. CISA said threat actors were targeting water organizations of all sizes and told even organizations with mature cybersecurity programs to validate external connections. Smaller utilities may have fewer people and less money to do that work, but size alone does not determine exposure.

Manual operations kept the water moving

In Braham, public works staff noticed a malfunction at the well feeding the water tower. They isolated the affected system, restored a backup, and restarted the plant in about 90 minutes. CBS reported no loss of water service, and the tower normally holds roughly two days of drinking water.

South St. Paul moved public works employees to manual operations without interrupting water or wastewater service. Plymouth found compromised PLCs at two water towers and fourteen sewer lift stations, disconnected them from the cellular network, and operated manually until normal communications returned Tuesday afternoon. CBS reported that treatment, pressure, quality, and delivery were not affected in either city.

Those outcomes depended on people who knew how to operate the systems without automation. A fallback plan is only useful if the staff on shift can run it and the procedure has been tested before an incident.

The equipment nobody remembers

I have walked into industrial and municipal sites and found home routers or access points plugged into switches because somebody needed office Wi-Fi, did not know the approved password, or wanted to work around a coverage problem. The equipment solved an immediate problem and then became part of the building without becoming part of the documentation.

Cellular equipment is easier to miss because its service may sit outside the utility's normal network and budget. Wireless monitoring can help find local radios, but it will not replace carrier records, physical inspection, and clear ownership.

The warning

Minnesota and federal officials had not publicly attributed the activity when CBS published its report, and investigators had not confirmed that every incident came from the same actor. That uncertainty matters. It also does not change the work on a utility's desk.

I see this as a shot across the bow for any community operating remote infrastructure. An attacker who can lock out an operator or break communications without using a novel technique has already shown that the basic controls need attention. The useful response is not speculation about the actor. It is a verified inventory, clean backups, and a manual plan the staff can execute.

Do this

• Pull the active SIM and address inventory from every carrier account, including accounts held by integrators.
• Match that list against drawings, accounting records, maintenance contracts, and the equipment in the field.
• Remove direct PLC exposure. Put required remote access behind a VPN, firewall, or secure gateway and restrict trusted sources.
• Change default credentials, disable unused radios and services, and log connections through cellular gateways.
• Compare running logic with a known-good baseline and verify clean backups before an incident.
• Test manual operations with the people who would actually be on shift.

Questions I keep getting

How do I know what an outside scanner can see? Search your address space with services such as Shodan or Censys, then verify the result with an authorized external scan. Treat search-index removal as privacy housekeeping, not remediation.

Was this Iran? Officials were investigating that possibility, but Minnesota and federal authorities had not publicly attributed the activity in the CBS report. Attribution does not change the immediate mitigation list.

Want this kind of thing weekly, in audio? That's the show.