Recommended Free Tools
A July 30, 2026, FBI and EPA warning says water and wastewater utilities in at least seven states reported incidents involving internet-facing Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers (PLCs). In reported cases, remote actors changed PLC IP addresses and passwords, disrupting monitoring or control; at least one utility also reported altered PLC project files. The agencies describe operational disruption, not confirmed drinking-water contamination.
What happened in the FBI and EPA warning?
The FBI and EPA said water and wastewater systems had reported incidents to the FBI since July 27, 2026. Their July 30 public service announcement (PSA) names Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs. It says some activity degraded water operations and that the observed access involved PLCs exposed directly to the internet. The “at least seven states” figure is the agencies’ count as of that PSA, not a final tally of utilities or affected states. FBI/EPA PSA, July 30, 2026.
As an Amazon Associate I earn from qualifying purchases.
The FBI and EPA say they observed this behavior with the named Rockwell PLCs, while advising operators of other brands to consider the same exposure risks. The notice does not identify a threat actor, motive, or exploited CVE, and it does not establish that a particular PLC vulnerability caused the incidents. The central warning is about internet exposure and weak access boundaries.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow did the campaign disrupt operations?
According to the FBI and EPA, actors remotely reached internet-facing PLCs and changed their IP addresses and passwords. That left operators unable to monitor or control the devices in the usual way. At least one organization reported modified PLC project files after finding ladder-logic discrepancies across several sites.
#1 Best Overall
The consequences varied with the controller’s role, the equipment and function involved, and whether operators could safely switch to manual operation. The FBI and EPA reported loss of pressure and flooding. CISA separately said the activity had resulted in boil-water notices and sustained manual operations. These are agency-reported effects, not evidence that every affected utility experienced the same outcome. CISA also warns that cellular modems used by operators, vendors, or integrators may be undocumented and missed by routine exposure scans. CISA bulletin, July 30, 2026.
The FBI says pressure loss could potentially allow untreated groundwater to seep into pipes. That is a stated risk, not a report of confirmed contamination. A PLC that only monitors a process can create a different operational problem from one that controls equipment; neither label by itself determines the real-world impact. Utilities need to know what each controller does and what safe fallback is available.
Rank #2
How should a water utility protect PLCs and remote access?
Prioritize removing direct public access to controllers. Password changes matter, but they do not replace network controls, monitoring, or recovery planning. The FBI/EPA PSA and CISA recommend mediated, restricted access rather than direct internet connections to PLCs.
- Remove direct inbound internet access. Place a firewall or secure gateway between the public network and OT. Remote operational sessions should pass through a VPN or gateway—not connect directly to the PLC. Permit only expected communications between authorized systems.
- Include cellular connections in the inventory. Find operator-, vendor-, and integrator-installed modems, including field devices that may not appear in routine scans. Use strong authentication, keep modem software current, enable logs, and restrict who can connect.
- Strengthen credentials. Replace default or weak passwords with unique, strong credentials. Treat credential changes as one control among several, not as a fix for public exposure.
- Control program changes. Use physical or software keyswitches to prevent unauthorized configuration changes. Review connected-device logs and inspect modems, HMIs, and workstations for possible lateral movement.
What should operators do before restoring a PLC?
Do not switch a controller back to run mode until its project file has been checked. The FBI/EPA PSA cautions that changing modes can lock in the current project file. A hasty return to service could therefore preserve an unauthorized or incorrect configuration.
Rank #3
- Establish the safe operating state. Follow the utility’s incident procedures and determine whether the process can be safely monitored or controlled manually.
- Preserve evidence and review logs. Record what changed and when; review connected modems, HMIs, and workstations as well as the PLC.
- Validate the project. Compare the controller’s project and logic with a known-clean, approved version before returning it to service.
- Restore from verified backups. Maintain known-clean PLC images and backups, and inspect them before use rather than assuming any available copy is safe.
- Confirm operation and recovery. Follow the utility’s approved process for restoring monitoring and control, then assess whether additional systems or credentials need attention.
Manual-operation capability is a core continuity measure, not an improvised substitute for incident planning. The FBI says, “The capability for organizations to revert to manual controls to quickly restore operations is vital in the immediate aftermath of an incident.” Utilities should practice safe manual operation and test continuity, fail-safe, islanding, standby, backup, and recovery procedures. A fallback that has not been tested may not be available when operators need it.
How should utilities plan for end-of-life PLCs?
The FBI/EPA PSA says end-of-life (EOL) hardware no longer receives manufacturer software updates or security patches. Utilities should plan around that support gap rather than treat old equipment as a permanent exception.
- Inventory PLCs and related assets by model, owner, and location.
- Review a rolling 12-month EOL forecast quarterly. This is the PSA’s planning recommendation, not a statistic about campaign activity.
- Replace or isolate unsupported assets where practical. If replacement cannot happen immediately, apply compensating controls and set firm decommission dates.
- Include safe migration effort and process continuity in the replacement plan; avoid making security changes that could disrupt control without an operationally reviewed plan.
Where can affected utilities get help?
The FBI/EPA PSA directs affected organizations to contact their local FBI field office and the Internet Crime Complaint Center (IC3). It also lists CISA’s 24/7 Operations Center and EPA water-sector Cybersecurity Technical Assistance. CISA asks reporters to include details such as the date, time, and location; activity type; affected people and equipment; and submitting organization and contact information.
EPA’s water-sector resource hub lists assessments, technical assistance, incident-response guidance, exercises, and funding resources. These are official support pathways for utilities assessing exposure or preparing response plans. EPA cybersecurity resources for the water sector.
Quick Recap
Best Value
- Application Scenes. USB programming cable Compatible for Allen Bradley PLC SLC 5 5 5 SLC500 and Micrologix1400. This cable is for transferring program/data between computer and PLCs, for USB-1747-CP3 Replacement.
- Converter Cable. USB 2.0 male to DB9 female adapter. Anti-interference. Its power is supplied by PC USB port. With LED communication indicators. Completely compatible with USB 1.1 and USB CDC V1.1.
- Supported OS and Driver. Support Windows 98XPVista 0 8 . Under the control of driver, the PC USB port is simulated as traditional COM. One key installation driver.
- Quality Cable. The original chip and SMT PCB built inside, every cable is tested manually.
- Technical Support. Scan the QR code printed on the label on the box, you can find, download and install the cable driver. Also, User Manual and Cable Driver will be sent to you by Email via Amazon platform, if you didn’t receive it, please contact our engineers by Email for technical support. Made by Washinglee, 1 year warranty.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
