Nearly one in five US water organisations has identity data actively exposed by infostealers
SpyCloud analysed about 10,000 EPA-registered water and wastewater organisations and found 1,787 with active infostealer exposure, of which 258 "carried credentials to operational technology" or remote-access systems. A single infected device at a smart-meter technology provider SpyCloud did not name held saved logins linked to roughly 167 US utility metering tenants. SpyCloud says exposure concentrated in larger operators and in the vendor supply chain, and that small utilities were largely underrepresented.
US agencies warn attackers are using AI-generated scripts to target Siemens S7 industrial controllers
A joint advisory (AA26-231A) from the NSA, CISA, FBI, DOE and EPA warned that threat actors are running persistent reconnaissance and capability development against internet-exposed Siemens S7 programmable logic controllers with weak or default credentials, and are using AI-assisted development to rapidly iterate exploit code — including AI-generated Python scripts that call the snap7.dll library to read PLC memory and configuration. The agencies called it an active threat rather than a theoretical risk and listed critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities as targeted sectors; no threat actor was attributed.
FBI and EPA alert on actors targeting internet-facing water-sector PLCs across at least seven states
The FBI issued an alert stating that since 27 July 2026 at least seven states have reported incidents in which malicious cyber actors changed IP addresses and passwords on internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs at water and wastewater utilities, causing loss of monitoring and control functionality, with operational impacts including loss of pressure and flooding. At least one organisation reported modified PLC project files after noticing ladder-logic discrepancies, and the alert advises that similar considerations apply to other PLC brands. The alert names no actor, state or country. Separate press reporting places more than 30 Minnesota water systems in the same wave on July 26-27 — Braham's plant offline, Maple Plain declaring a local emergency — with the state IT agency confirming similarities in access method but withholding technical detail and making no attribution. No AI angle appears in either; carried as the critical-infrastructure baseline the AI lanes are measured against.
US advisory: Iran-linked actors manipulating Rockwell, Siemens and Schneider PLCs
A US government advisory (CISA/FBI/NSA/EPA), updated July 22, warns Iran-linked actors are using vendors' own engineering software to alter project files on Rockwell, Siemens (S7-1200) and Schneider (Modicon M340) PLCs — disabling shutdown and alarm logic at US water, energy and government facilities, with at least one confirmed US victim. No direct AI angle, but a strategically significant critical-infrastructure escalation.