August 11, 2026
Urgent Cybersecurity Advisory for Water and Wastewater Agencies
Recent alerts from the Cybersecurity and Infrastructure Security Agency (CISA), WaterISAC, the Environmental Protection Agency (EPA), and other federal partners warn of increased cyber threats targeting water and wastewater agencies across the United States. Several agencies have already experienced operational impacts, and federal agencies are urging immediate action to identify and secure vulnerable systems. What You Need to Know
Federal cybersecurity authorities are observing active attempts by threat actors to target internet-connected operational technology (OT), including programmable logic controllers (PLCs) commonly used in water and wastewater operations. These attacks have affected multiple critical infrastructure sectors and, in some cases, resulted in operational disruptions and financial losses.
Of particular concern are PLCs and remote access systems that are directly exposed to the internet, including systems connected through cellular modems. The advisory notes that threat actors are targeting internet-facing operational technology assets and exploiting weak or misconfigured remote access pathways.
Recommended Actions
Agencies are strongly encouraged to:
Review the latest cybersecurity advisories and implement recommended mitigations as soon as possible.
Identify internet-facing operational technology, communications systems, and remote access connections, especially those using cellular communications.
Remove PLCs from direct internet exposure whenever possible and secure remote access using current best practices.
Ensure strong authentication is enabled on all remote access points and eliminate default passwords.
Pay particular attention to remote facilities, including tanks, pump stations, and other unmanned sites.
Contact third-party vendors and service providers to verify they are following current cybersecurity best practices and mitigation guidance.
Maintain heightened vigilance and report suspicious activity through established reporting channels.
Assistance and Resources
Federal agencies are offering assistance and guidance to water sector organizations:
EPA Cybersecurity Technical Assistance Program for the Water Sector Request Technical Assistance
CISA Regional Offices Find Your Local CISA Regional Office
WaterISAC Resources and Incident Reporting WaterISAC
EPA Cybersecurity Response and Reporting Resources EPA Cybersecurity Response Resources
CISA Cyber Incident Reporting
Report a Cyber Issue to CISAFBI Internet Crime Complaint Center (IC3)Â Submit an IC3 Report
Free WaterISAC Membership for Small Water Utilities Learn More
WaterISAC and federal partners have emphasized the importance of helping smaller water and wastewater agencies that may have limited cybersecurity resources. Utilities are encouraged to share this information broadly with operational, IT, and leadership teams.
Stay Vigilant
As cyber threats against critical infrastructure continue to evolve, proactive security measures are essential to protecting water and wastewater operations. BAYWORK encourages all member agencies to review the latest advisories, assess their exposure to internet-connected operational technology, and implement recommended safeguards without delay.
For more on the subject, check out BAYWORK’s 2025 Water Summit presentation on Cybersecurity here: https://www.baywork.org/workshop/baywork-water-industry-summit-2025
Questions?
Contact Laura Combs, BAYWORK Manager, at
laura.combs@baywork.org
Please post or forward this email to your agency or any other interested parties.