CISA Alert: Water Sector PLC Targeting - Censys
Join the Censys ARC Webcast on August 12 (live Q&A for attendees only)
Register Now
Platform
Platform
Description<br>The one place to understand and act on everything on the Internet.
Platform Overview
Internet Map
Integrations
AI at Censys
Description<br>Purpose-built capabilities that power security operations and exposure management.
Censys Search
Censys Core
Adversary Investigation
Attack Surface Management
Critical Infrastructure Monitoring
Featured Post
Censys Powers SOC Modernization with Real-Time Internet Context and Risk Scoring
Read More
Solutions
Solutions
Description<br>Use-case guides for modern security teams: investigate, prioritize, respond, and reduce risk.
SOC Modernization
Adversary Intelligence & Threat Hunting
External Exposure Management
Critical Infrastructure Resilience
Description<br>Industries bring unique exposures and adversaries.<br>Learn how Censys can help.
Cybersecurity
Energy & Utilities
Financial Services
Government
Healthcare
Featured Post
Detection Engineering in the Modern SOC eBook
Read More
Censys ARC Research
Censys ARC Research
Description<br>Threat, vulnerability, and Internet intelligence built from expansive first-party visibility. The mission: to illuminate Internet behaviors that impact our world.
Censys ARC
Latest Research
Rapid Response Advisories
Threat Intelligence
Featured Post
Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework
Read More
Resources
Resources
Description<br>Explore Censys updates on products and partnerships, plus thought leadership on Internet risk trends.
Blog
Resource Hub
Integrations
Reports
Case Studies
Events
Webinars
Pricing
Developers
Documentation
Community
Compliance
Glossary
Company
Company
Description<br>Learn more about the Censys mission and the talented team behind it.
About Us
Leadership
Newsroom
Our Customers
Partners
Careers
Censys Raises $70 Million in Strategic Funding to Expand Its Internet Intelligence Platform
Read More
Request Demo
Get Started Now
Login
Platform
Platform
Description<br>The one place to understand and act on everything on the Internet.
Platform Overview
Internet Map
Integrations
AI at Censys
Description<br>Purpose-built capabilities that power security operations and exposure management.
Censys Search
Censys Core
Adversary Investigation
Attack Surface Management
Critical Infrastructure Monitoring
Featured Post
Censys Powers SOC Modernization with Real-Time Internet Context and Risk Scoring
Read More
Solutions
Solutions
Description<br>Use-case guides for modern security teams: investigate, prioritize, respond, and reduce risk.
SOC Modernization
Adversary Intelligence & Threat Hunting
External Exposure Management
Critical Infrastructure Resilience
Description<br>Industries bring unique exposures and adversaries.<br>Learn how Censys can help.
Cybersecurity
Energy & Utilities
Financial Services
Government
Healthcare
Featured Post
Detection Engineering in the Modern SOC eBook
Read More
Censys ARC Research
Censys ARC Research
Description<br>Threat, vulnerability, and Internet intelligence built from expansive first-party visibility. The mission: to illuminate Internet behaviors that impact our world.
Censys ARC
Latest Research
Rapid Response Advisories
Threat Intelligence
Featured Post
Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework
Read More
Resources
Resources
Description<br>Explore Censys updates on products and partnerships, plus thought leadership on Internet risk trends.
Blog
Resource Hub
Integrations
Reports
Case Studies
Events
Webinars
Pricing
Developers
Documentation
Community
Compliance
Glossary
Company
Company
Description<br>Learn more about the Censys mission and the talented team behind it.
About Us
Leadership
Newsroom
Our Customers
Partners
Careers
Censys Raises $70 Million in Strategic Funding to Expand Its Internet Intelligence Platform
Read More
Request Demo
Get Started Now
Login
Resources1 › Blog2
BLOG ◆<br>◆ --><br>JUL 30, 2026
CISA Alert: Water Sector PLC Targeting<br>Internet Exposure Assessment in Response to CISA Advisory AA26-097A
Iran, Research, Threat Intelligence
Download the full brief →
Introduction
CISA issued an alert on July 30, 2026 warning that threat actors are increasingly targeting internet-exposed programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) sector, in some cases modifying passwords to lock out operators and disconnecting devices by changing their IP addresses, resulting in boil-water notices and sustained manual operations. CISA named Rockwell Automation/Allen-Bradley, Siemens, and Schneider Electric equipment and flagged cellular modems as a common blind spot in routine attack-surface scans. This report characterizes current Censys-observed internet exposure for each named vendor: 4,148 Rockwell/Allen-Bradley EtherNet/IP hosts, 4,117...