Let’s talk about water. Not what comes out of your tap, but the operational technology (OT) that treats and moves it. Because when you look at the state of water sector OT security across two incidents a decade apart, Bowman Dam in 2013 and the Minnesota water attacks in July 2026, the story is not one of progress. It’s one of a threat that kept knocking on the same doors, and in too many places, finding them still unlocked.
That should bother all of us.
In August and September of 2013, an Iranian national repeatedly gained unauthorized access to the SCADA systems controlling the Bowman Avenue Dam in Rye, New York. He could see water levels, temperature readings, and the status of the sluice gate, the mechanism that controls water flow. Had the sluice gate not been disconnected for maintenance at the time, he could have operated it remotely.
The intrusion was discovered. The DOJ eventually unsealed the indictment in 2016, and it was a landmark moment: the first time a nation-state actor was publicly charged for attacking U.S. water infrastructure. The tradecraft at Bowman was not complicated. An internet-connected OT device with exposure that shouldn’t have existed was accessed by a persistent, nation-state actor. The attacker got in, looked around, and would have had control if circumstances had been slightly different. It was a reconnaissance mission that could have been an operation.
The U.S. government’s message at the time was clear: this is a frightening new frontier. Water infrastructure is vulnerable.
On the weekend of July 26 and 27, 2026, more than 30 municipal water and wastewater utilities across Minnesota lost operational visibility and control over their systems. Attackers reached MicroLogix 1100 and 1400 series programmable logic controllers that were directly exposed to the internet through cellular links at water towers and lift stations. They changed device IP addresses, reset passwords, and locked operators out of their own equipment. The city of Braham took its water plant offline entirely. Plymouth lost cellular connectivity across multiple sites and fell back to manual operations. Maple Plain declared a local state of emergency.
Within days, the FBI and EPA confirmed similar intrusions in at least seven states. CISA issued an urgent advisory urging every water utility in the country to pull its controllers off the public internet immediately. CISA advisory AA26-097A, updated just four days before the Minnesota activity began, documents a broader campaign of PLC exploitation tied to Iran-affiliated actors, specifically CyberAv3ngers and affiliated hacktivist groups operating through what has been described as an “Electronic Operations Room.” The targeting is consistent with Iranian cyber operations that have escalated in parallel with kinetic hostilities in 2026.
No data was stolen. No ransom was demanded. No water was contaminated. But operators could not see or control their systems. In a sector where loss of view and loss of control carry direct public health consequences, that’s impact.
The first thing you notice when you lay these incidents side by side is how much the attack surface didn’t change. Both attacks exploited internet-connected OT devices with inadequate access controls. Both targeted water infrastructure specifically as the objective. And in both cases, the attackers did not need sophisticated, custom-built malware. They used what was available: access to exposed systems, default or weak credentials, and knowledge of how OT protocols work.
At Bowman, it was a single internet-connected ICS device. In Minnesota, it was dozens of PLCs reachable over cellular links, exploitable through a known authentication bypass vulnerability, (CVE-2021-22681) that was first disclosed in 2021 and added to CISA’s Known Exploited Vulnerabilities catalog in March 2026, five years after initial disclosure. That gap between disclosure and confirmed exploitation reflects the persistent challenge of patching OT environments, where operational continuity routinely takes priority over security updates.
Both events also shared an adversary posture. They were deliberate campaigns against critical infrastructure, timed and targeted. They are patient. They are persistent. And they are watching for the same gaps they found the first time.
First, the promising news. Some things have changed meaningfully over the past decade.
Awareness and attribution. The 2016 indictments following the Bowman intrusion were historic. For the first time, the U.S. government publicly named and charged the individuals behind an attack on water infrastructure. That set a precedent for naming nation-state cyber actors and applying legal accountability, even when arrest is unlikely. In 2026, CISA’s advisory infrastructure, the FBI’s rapid engagement after Minnesota, and the EPA’s coordination represent a response posture that simply did not exist in 2013.
Threat intelligence. The understanding of adversary groups targeting OT environments has grown dramatically. In 2013, the concept of nation-state actors specifically pursuing ICS environments with OT-native tradecraft was not widely operationalized in the water sector. Today, tracked threat groups like CyberAv3ngers have multi-phase campaign timelines that are documented, published, and actionable, from their initial default-credential exploitation to custom malware platforms to authentication bypass techniques. Dragos tracks more than 26 OT-specific threat groups by name. That depth of adversary knowledge is what separates effective OT defense from hope. (Which I feel compelled to say that hope is not a strategy.)
Policy and regulatory attention. Water sector cybersecurity has moved up the policy agenda. America’s Water Infrastructure Act, Executive Orders on ICS security, and CISA’s sector-specific programs reflect a recognition that water systems are critical infrastructure that requires dedicated focus, not afterthought coverage under broader IT security frameworks.
Incident response coordination. Minnesota’s statewide response which included activating MNIT’s whole-of-state cybersecurity program, coordinating across state, local, tribal, and federal partners, worked. And while it did not prevent the attack, it contained the impact. That coordination capability represents marked maturity compared to where most of the sector was a decade ago.
Here is the areas.
Asset visibility is still a fundamental problem. Do you REALLY have full situational awareness that extends past traditional OT to extended operational technology (xOT). That principle sits at the core of xOT security, and it remains unresolved for a significant portion of the water sector. The Minnesota attackers found these same gaps, internet-exposed PLCs, no network segmentation, no monitoring south of the firewall, across more than 30 utilities in a single weekend. That is a systemic visibility failure repeated at scale.
xOTrisks are not theoretical anymore. Water utilities connected their operational technology to the internet for legitimate reasons: remote monitoring, fewer site visits, faster response times. That connectivity created the attack surface. The same cellular links that let operators check on a water tower from the office let adversaries connect to that PLC from anywhere in the world. The OT network boundary is porous (sometimes planned, sometimes unplanned) in ways that the sector has not kept pace with securing.
Patching in OT environments remains operationally hard and chronically delayed. CVE-2021-22681 carried a CVSS score of 9.8. It was disclosed in 2021. It was actively exploited in 2026. That five-year gap is not unique but is hugely concerning. It reflects a structural tension in OT environments: patching requires downtime, downtime requires planning, and in water treatment, operational continuity is not a preference, it is a public health mandate. The answer is not simply “patch faster.” The answer requires risk prioritization frameworks that account for OT context which involves understanding which vulnerabilities represent actual exploitable risk in a specific environment, and sequencing remediation accordingly. Only 3-6% of OT vulnerabilities require immediate action, according to Dragos data. The challenge is knowing which 3-6%.
The threat is maturing faster than defenses in the water sector. CyberAv3ngers’ techniques have proliferated to more than 60 affiliated hacktivist groups that have adopted the same playbook, coordinated through shared infrastructure. That distributed threat model means degrading the core group does not eliminate the risk. The capability is out there. The playbook is documented. The attack surface has not shrunk.
The answer is not a single product or a single policy. It is a discipline. Remove OT from the public internet where it does not need to be there. Any remote operational access should route through a VPN or SRA gateway device.
Establish visibility before you can claim you have monitoring. Asset discovery, protocol-aware network monitoring, and detection capabilities that understand OT behaviors are the foundation. Without them, you are operating blind and calling it acceptable.
Build vulnerability management that accounts for OT context. Not all vulnerabilities are equal. Prioritization requires understanding which assets are actually reachable, which vulnerabilities map to known adversary techniques, and what the operational impact of a remediation window looks like in a specific environment.
Invest in collective defense. No small utility is going to build an in-house OT threat intelligence program. But collective defense programs that share threat indicators, coordinated response frameworks, & shared monitoring capabilities can extend protection to organizations that cannot afford to build it alone.
Take threat intelligence seriously. The CISA advisory warning of active exploitation of internet-connected PLCs by Iranian-affiliated actors was updated four days before Minnesota. Four days. Defenders who were tracking that advisory had time to act. Many did not, or could not, or did not know to. Intelligence is only useful when it reaches the practitioners who can act on it.
A decade after Bowman Dam, the threat actor profile looks familiar, the attack surface looks familiar, and the fundamental gaps look familiar. What has changed is the scale. One ICS device in 2013. More than 30 utilities across seven states in 2026. The adversaries who target water infrastructure are not sophisticated in the way we sometimes use that word; meaning exotic zero-days and elaborate tradecraft. They are sophisticated in the way that they understand OT environments. They are patient, they do their reconnaissance, and they exploit the gaps that defenders have not closed. They are also, increasingly, operating in a geopolitical context where attacks on U.S. water infrastructure carry strategic intent, not just nuisance value.
Water is a soft target because the sector has chronically underinvested in OT-specific security, and because the cost of not investing has, until now, felt abstract. Minnesota made it concrete.
The question now is whether the sector treats this as the inflection point it is, or whether we have this same conversation a decade from now, looking back at the next set of incidents that followed predictably from the same unresolved gaps.
