Public Warnings, Private Gaps
A clip going around says the public cannot see what threatens infrastructure. For water systems, the warnings are public, detailed and recent. This brief reads them as a buyer would: what happened, what is still uncertain, and what to put in the next scope.
As of October 16, 2026. Every figure below was checked against its source, and anything we could not verify is labeled.
Read the text version of the graphic
Sticky notes.
- Big Picture: A clip says infrastructure threats are unseen. For water, the warnings are public.
- What Just Happened: Oct. 13: analysis revisits CISA's count: 100+ internet-exposed water entities in July, up from about 30.
- Why It Matters: Attackers reached internet-exposed controllers and changed settings. Some utilities lost pressure.
- Who It Affects: Water utilities, cities, integrators and vendors that install remote access.
- What Comes Next: Federal guidance urges utilities to take controllers off the public internet and rehearse manual operation.
- GOTB Angle: Contract for an inventory of every remote connection and a rehearsed manual fallback.
Study guide.
- The Claim: A clip says infrastructure threats are unseen. Federal advisories are public and detailed. (FBI/EPA PSA, 7/30/26)
- The Attack: Since July 27, utilities in 7+ states reported changed controller addresses and passwords. (FBI/EPA PSA, 7/30/26)
- The Scale: CISA observed activity against 100+ internet-exposed entities, up from about 30. The 12-state figure is press reporting. (IOActive, 10/13/26 (citing CISA, 8/21/26))
- The Actors: Reports link July to Iran; CISA names no actor. Pro-Russia hacktivists used exposed remote access, at lower skill. (CISA AA25-343A, 12/18/25)
- The Fix: Take controllers off the internet, plan end-of-life swaps, practice manual operation. (FBI/EPA PSA, 7/30/26)
Key takeaway. You can't protect what isn't on the list. Make the inventory a contract deliverable.
The numbers
The 100+ count comes from CISA’s own observation, as relayed by a security firm, not from utility reports. The “at least 12 states” figure is press reporting, not CISA.
What the sources say
Controllers reached over the internet
The FBI and EPA say that since July 27, 2026, water and wastewater utilities in at least seven states reported attackers reaching internet-facing programmable logic controllers and changing their IP addresses and passwords. Effects included loss of monitoring and control and, in some cases, loss of pressure and flooding. At least one organization saw modified project files.
Source: FBI/EPA alert, July 30, 2026A measurement gap
A security firm’s analysis revisits CISA’s Aug. 21 guidance: CISA says it observed malicious activity targeting more than 100 internet-exposed water-sector entities in July, up from roughly 30 described earlier. The firm reads the jump as a measurement gap, because CISA looked in from outside rather than relying on utilities to report. Attribution to Iran in press reports is contested, and CISA’s guidance names no actor.
Source: IOActive, Oct. 13, 2026Low skill, real harm
Separately, CISA and partners documented pro-Russia hacktivists using minimally secured, internet-facing remote-access connections to reach operational technology in water, food and energy systems. The attacks were “less sophisticated” and opportunistic, yet some caused physical damage.
Source: CISA AA25-343AReading it fairly
A vendor wrote the analysis
IOActive sells security services, so treat its reading as one informed view. The 100+ figure is CISA’s observation relayed by that firm, the state count is press reporting, and the attribution to Iran is contested rather than settled.
Source: IOActiveIntegrators may install what no one lists
The federal alert notes that similar network setups installed by third parties can let attackers repeat their success. CISA warns that cellular modems may be installed by operators, vendors or integrators and may be undocumented.
Source: FBI/EPA alert; IOActive, citing CISARemove, gate, plan, rehearse
Federal guidance starts by removing controllers from direct internet exposure and putting needed remote access behind a secure gateway. Strong unique passwords, access controls, physical key switches in run mode, reviewing project files and practicing manual operation follow. The alert recommends a rolling 12-month end-of-life forecast, reviewed quarterly with owners and procurement.
Source: FBI/EPA alertWhat this means for utilities and their integrators
- Make the inventory a deliverable. Ask integrators for the external IP address and owner of every remote connection they installed, and keep the list current.
- Gate remote access. Specify a secure gateway for any remote access that is truly needed, instead of direct connections.
- Plan replacements. Keep a rolling end-of-life forecast for controllers and review it with procurement each quarter.
- Rehearse manual operation. Include a rehearsed manual fallback under the utility’s own safe-operating procedures.
- Keep it fair. Small and local integrators who can document and maintain these systems are worth watching, and clear scopes help them compete.
What we could not verify
- Who is behind July’s attacks. Press reports link the wave to Iran. CISA’s guidance names no actor, and we make no attribution.
- The state count. “At least 12 states” is press reporting relayed by IOActive. The federal alert itself says at least seven states.
- The 100+ figure. We read it as relayed by IOActive. We did not locate the CISA guidance text ourselves for this page.
- Illinois. IOActive says Illinois is not on the public list of affected states. We could not verify that and do not rely on it.
- The viral clip. We did not verify any social video, and no social caption is used as a source on this page.
Sources, checked on October 16, 2026
- FBI and EPA, Public Service Announcement I-073026-PSA on water and wastewater controllers (July 30, 2026)
- IOActive, “From 30 Systems to Over 100: What CISA’s Revised Water Sector Figures Reveal About the OT Detection Gap” (Oct. 13, 2026)
- CISA and partners, AA25-343A, pro-Russia hacktivists and critical infrastructure (last revised Dec. 18, 2025)
What is ours. The plain-words boxes and the points on contracts and procurement are GOTB’s interpretation, labeled as such. Everything else is quoted or counted from the sources above.
Claims and findings. This brief summarizes public advisories and one vendor analysis. It does not assess any specific utility, vendor or product, and it makes no attribution of any attack.
This page is general information, not legal, engineering, security or investment advice, and it does not promote any product or company. Figures are as reported by the sources linked, as of October 16, 2026.
About
Meet Michael E. Brown
President and Managing Partner, GOTB Consulting, LLC · Chicago
Michael E. Brown has 20+ years of governmental and municipal consulting and lobbying experience. He was lead contract negotiator on the $8.5B O’Hare 21 program and the $800M O’Hare rail extension, and lead lobbyist and contract negotiator on the $400M Chicago Department of Water Management lateral redevelopment. (Dollar figures are program sizes, not GOTB fees.)
He has worked with the Illinois legislature and public officials on public-private partnership (P3) policy, and has consulted to the Cook County Commission on reducing duplicative administrative offices. He is a frequent speaker at governmental and municipal functions, focuses on good government and healthier social and economic solutions for safe, successful neighborhoods, lives in Chicago, and serves on the Board of the March of Dimes.
- M.S., Psychology (1997), University of Iowa
- B.S., Psychology (1995), University of Iowa
About
Meet Richard Butler
Partner, GOTB Consulting, LLC · Chicago
Richard (Rich) Butler is a partner at GOTB Consulting and a 38-year veteran of Chicago city government. From August 2019 to February 2020 he served as First Deputy Commissioner and Chief Administrative Officer of the Chicago Department of Aviation (CDA), responsible for day-to-day administration and operations of O’Hare and Midway, including finance, contracts, operations, legal, human resources, workforce development, concessions, real estate and vehicle services. CDA manages the two airports with a federally funded budget of $8.5 billion. (Dollar figures are budget and program sizes, not GOTB fees.)
Before that, Rich was First Deputy Procurement Officer at the City’s Department of Procurement Services and Chief Administrative Officer of the Chicago Park District, where he oversaw procurement, audit, finance, warehousing and general administrative services on an estimated annual budget of $385 million and established district-wide policies and procedures. His City career began at the Department of Aviation as Director of Contracts Administration, and he also served as General Superintendent of the Department of Streets and Sanitation.
He completed the Chicago Accounting and Purchasing System Training Program and the City of Chicago Executive Management Program, was a key team member on the design and implementation plan for the City’s new eProcurement system, and is a member of the National Institute of Governmental Purchasing and the Purchasing Management Association of Chicago. He has served on the board of the Chicago Municipal Employees Credit Union and on the US Communities board, representing the City of Chicago, and traveled to South Korea to represent Chicago in the Kotra Alliance to bridge contracting opportunities. A native of Englewood, he attended De La Salle High School.
- B.S., Northern Illinois University
Fictional characters from GOTB’s original stories. Real-world facts always link to public sources.