# Federal Agencies Warn Water Utilities on Cybersecurity

In 2026, over 100 U.S. water and wastewater utilities across at least seven states, including Pennsylvania, have been targeted by cyberattacks exploiting exposed programmable logic controllers (PLCs) connected directly to the internet without adequate security. Federal agencies such as the FBI, EPA, and CISA have issued warnings and guidance urging these utilities to implement fundamental cybersecurity measures including VPNs, password changes, network segmentation, and configuration backups. This situation underscores a critical gap in binding federal cybersecurity mandates for operational technology in the water sector, creating procurement opportunities for cybersecurity firms specializing in industrial control systems protection.

- **Why this matters:** Federal warnings highlight urgent cybersecurity vulnerabilities in water infrastructure, signaling increased demand for secure industrial control system solutions.
- Agencies and utilities are likely to prioritize procurement of cybersecurity services and hardware that address PLC exposure and network segmentation.
- Companies specializing in industrial cybersecurity, especially those with expertise in operational technology, can leverage this environment to offer consulting, monitoring, and remediation services.
- Procurement professionals should anticipate evolving requirements and potential future mandates to enhance water sector cybersecurity compliance and resilience.

**Jurisdictions:** federal
**Industries:** Public Safety
**Topics:** Cybersecurity
**Published:** September 22, 2026

### Government Entities
- Federal Bureau of Investigation (FBI)
- Environmental Protection Agency (EPA)
- Cybersecurity and Infrastructure Security Agency (CISA)

### Vendors
- Rockwell Automation (hardware vendor)
- Dragos (industrial cybersecurity firm)

### Key Quotes
> These systems were directly on the internet with no firewalls or VPNs or anything, with no passwords set in most cases.
> — Lesley Carhart, Director of Industrial Control Systems Security at Dragos

### Sources
- [100+ US Water Plants Hacked via Exposed PLCs [2026]](https://shattered.io/us-water-plc-hack-100-exposed-2026) - shattered.io