C0066: 2026 U.S. Water Utilities Attacks
2026 U.S. Water Utilities Attacks was a campaign against more than 30 municipal water and wastewater utilities in Minnesota, beginning 27 July 2026, amid a wider pattern of similar activity the FBI and EPA reported across at least seven U.S. states.[1][2] The adversary targeted internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series programmable logic controllers reachable through cellular gateways at water towers and sewer lift stations, remotely accessing them and reconfiguring their IP addresses and passwords to lock operators out of monitoring and control functions.[3][4] At least one victim organization's PLC program logic was altered, and reported operational effects included loss of water pressure and flooding, with one utility taking its treatment plant offline entirely.[4][2] The campaign has not been formally attributed; some reporting describes the broader pattern as consistent with Iranian-affiliated activity, but attribution for the Minnesota intrusions specifically remains unconfirmed.[1]
Security context for executives and security teams
C0066: 2026 U.S. Water Utilities Attacks describes [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066) was a campaign against more than 30 municipal water and wastewater utilities in Minnesota, beginning 27 July 2026, amid a wider pattern of similar activity the FBI and EPA reported across at least seven U.S. states.(Citation: Dragos Water Under Attack)(Citation: FBI Water and Wastewater) The adversary targeted internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series programmable logic controllers reachable through...
Executive priority
C0066: 2026 U.S. Water Utilities Attacks is an official MITRE ATT&CK campaign. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate C0066: 2026 U.S. Water Utilities Attacks by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether C0066: 2026 U.S. Water Utilities Attacks appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
2026 U.S. Water Utilities Attacks
2026 U.S. Water Utilities Attacks was a campaign against more than 30 municipal water and wastewater utilities in Minnesota, beginning 27 July 2026, amid a wider pattern of similar activity the FBI and EPA reported across at least seven U.S. states.[1][2] The adversary targeted internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series programmable logic controllers reachable through cellular gateways at water towers and sewer lift stations, remotely accessing them and reconfiguring their IP addresses and passwords to lock operators out of monitoring and control functions.[3][4] At least one victim organization's PLC program logic was altered, and reported operational effects included loss of water pressure and flooding, with one utility taking its treatment plant offline entirely.[4][2] The campaign has not been formally attributed; some reporting describes the broader pattern as consistent with Iranian-affiliated activity, but attribution for the Minnesota intrusions specifically remains unconfirmed.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| ICS | T0813 | Denial of Control | During the 2026 U.S. Water Utilities Attacks, the adversary denied operators the ability to control their systems by shutting down and disabling computerized water plant controls via malware over a wireless connection.[3][4][1] |
| ICS | T0892 | Change Credential | During the 2026 U.S. Water Utilities Attacks, the adversary remotely accessed internet-facing devices (e.g., MicroLogix 1100 and 1400 controllers, etc.) and changed passwords resulting in loss of monitoring and control for the affected utilities.[3][4][1][2] |
| ICS | T0829 | Loss of View | During the 2026 U.S. Water Utilities Attacks, the adversary changed passwords on internet-facing MicroLogix controllers, causing the affected utilities to lose monitoring of their equipment (e.g., water tower, lift station, etc.).[3][4][1][2] |
| ICS | T1694.001 | Default CredentialsSub-technique | During the 2026 U.S. Water Utilities Attacks, the adversary logged in to internet-exposed PLCs using default credentials.[3] |
| ICS | T0827 | Loss of Control | During the 2026 U.S. Water Utilities Attacks, the adversary changed passwords on internet-facing MicroLogix controllers, locking out operators, and causing water and wastewater utilities to lose control of their equipment (e.g., controllers, water towers, lift stations).[3][4][1][2] |
| ICS | T0836 | Modify Parameter | During the 2026 U.S. Water Utilities Attacks, the adversary changed the IP addresses of internet-facing MicroLogix controllers, altering their network configuration settings outside normal operations.[3][4][1][2] |
| ICS | T0826 | Loss of Availability | During the 2026 U.S. Water Utilities Attacks, the adversary temporarily shut down the well and water treatment plant, causing loss of cellular connectivity across multiple sites interrupting the service the plant provides leading operators to revert to manual operations.[3][1] During the 2026 U.S. Water Utilities Attacks, the adversary caused loss of water pressure and flooding at affected water and wastewater utilities.[2] |
| ICS | T0889 | Modify Program | During the 2026 U.S. Water Utilities Attacks, the adversary altered the control logic (e.g., project files) of internet-exposed PLCs, producing ladder logic discrepancies, changing how the affected controller interacted with its process, after gaining access through default credentials.[3][4][2] |
| ICS | T0883 | Internet Accessible Device | During the 2026 U.S. Water Utilities Attacks, the adversary located internet-exposed PLCs (e.g., Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs, etc.) at water and wastewater utilities, including cellular-connected water towers and sewer lift stations, and logged in to them directly.[3][4][2] |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.0 | Current bundle | 020af5c60cf1… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Dragos Water Under Attack
Michael Rothschild. (2026, August 13). Water Under Attack: A Decade of Warnings, and the Same Gaps Still Open. Retrieved October 8, 2026.
Open source URL - [2]FBI Water and Wastewater
FBI Press Office. (2026, July 30). Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions. Retrieved October 8, 2026.
Open source URL - [3]Tenable Minnesota Water Utilities
Research Special Operations. (2026, July 28). Coordinated "cyberattack" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.
Open source URL - [4]Forescout Water Systems Attack
Sai Molige. (2026, August 5). OT Security Analysis: Exposed Devices Attacked in US Water Systems. Retrieved October 8, 2026.
Open source URL - [5]mitre-attackC0066Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.