The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
Minnesota Water Systems Cyberattack 2026: A Wake-Up Call for Critical Infrastructure Security
In late July 2026, over 30 municipal water systems across Minnesota experienced coordinated cyberattacks that disrupted operational controls, leading to temporary shutdowns and water conservation advisories in cities such as Braham, Plymouth, South St. Paul, and Maple Plain. While no significant water quality issues were reported, the attacks highlighted vulnerabilities in critical infrastructure. U.S. authorities, including the FBI and CISA, have attributed these incidents to Iranian state-sponsored hackers, aligning with prior warnings about increased Iranian cyber activities targeting U.S. water and energy sectors. ([apnews.com](https://apnews.com/article/5bb1dcbaab8e3231889700c38a21e8ea?utm_source=openai)) This incident underscores the escalating threat landscape facing U.S. critical infrastructure, particularly in the water sector. The attacks serve as a stark reminder of the need for enhanced cybersecurity measures and vigilance against state-sponsored cyber threats targeting essential services.
1 month ago
Kill Chain
CISA Issues Urgent Alert on Cyberattacks Targeting U.S. Water Utilities
In late July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert regarding a significant increase in cyberattacks targeting internet-exposed programmable logic controllers (PLCs) within the water and wastewater systems sector. These attacks, which began on July 26, 2026, involved hackers altering PLC configurations, changing passwords to lock operators out, and modifying IP addresses to disconnect devices from the internet, leading to operational disruptions. Over 30 community water systems in Minnesota were affected, with some utilities forced to switch to manual operations due to equipment malfunctions. This incident underscores the escalating cyber threats facing critical infrastructure, particularly in the water sector. The attackers' focus on internet-exposed PLCs highlights the urgent need for enhanced cybersecurity measures to protect operational technology from unauthorized access and potential sabotage.
1 month ago
Kill Chain
Minnesota Water Utility Cyberattack 2026: A Wake-Up Call for Critical Infrastructure Security
In late July 2026, over 30 community water systems in Minnesota experienced cyberattacks attributed to Iranian-affiliated actors. These attacks disrupted automated control systems, necessitating a temporary switch to manual operations. While water supply and quality remained largely unaffected, cities like Braham and Plymouth advised residents to limit water usage during the incidents. ([apnews.com](https://apnews.com/article/5bb1dcbaab8e3231889700c38a21e8ea?utm_source=openai)) This incident underscores the escalating cyber threats targeting U.S. critical infrastructure, particularly in the water sector. It highlights the vulnerabilities of operational technology systems and the pressing need for enhanced cybersecurity measures to protect essential services. ([csis.org](https://www.csis.org/analysis/iranian-cyber-threat-us-critical-infrastructure?utm_source=openai))
1 month ago
Kill Chain
Critical Vulnerabilities Discovered in Open62541
In July 2026, multiple vulnerabilities were identified in o6 Automation GmbH's Open62541, an open-source OPC UA stack widely used in industrial automation. These vulnerabilities, including CVE-2026-63362, CVE-2026-65423, CVE-2026-63035, and CVE-2026-63559, affect versions from 1.3.0 to 1.5.4 and the master branch. Exploitation could allow attackers to disclose sensitive information, cause denial-of-service conditions, or execute arbitrary code. ([aviatrix.ai](https://aviatrix.ai/threat-research-center/o6-automation-gmbh-open62541-vulnerability-2026/?utm_source=openai)) The discovery of these vulnerabilities underscores the critical importance of rigorous security practices in industrial automation software. Organizations utilizing Open62541 should promptly upgrade to the latest version to mitigate these risks. Additionally, implementing network segmentation and minimizing exposure of control systems to external networks are essential steps to enhance security posture.
1 month ago
Kill Chain
Critical Vulnerability in Rockwell Automation's ControlLogix and CompactLogix Controllers
In July 2026, Rockwell Automation disclosed a security vulnerability (CVE-2026-9636) affecting its CompactLogix 5380, ControlLogix 5580, and 1756-EN4TR communication modules. The flaw involves improper handling of Certificate Revocation Lists (CRLs), allowing attackers to use revoked certificates to establish unauthorized connections, potentially bypassing CIP Security protections. This vulnerability impacts firmware versions V36 to V37 for the affected products. ([rockwellautomation.com](https://www.rockwellautomation.com/es-es/trust-center/security-advisories/advisory.SD1788.html?utm_source=openai)) The incident underscores the critical importance of robust certificate validation processes in industrial control systems. As cyber threats targeting critical infrastructure continue to evolve, organizations must prioritize timely firmware updates and adhere to security best practices to mitigate potential risks.
1 month ago
Kill Chain
Critical Vulnerabilities in MZ Automation's lib60870: CVE-2026-61893 and CVE-2026-63033
In July 2026, MZ Automation's lib60870 library, widely used in industrial control systems, was found to have critical vulnerabilities identified as CVE-2026-61893 and CVE-2026-63033. These flaws, present in version 2.4.0, could be exploited by attackers to crash the parsing process, leading to a denial of service. The vulnerabilities stem from out-of-bounds read errors triggered by specially crafted IEC 60870-5-104 I-frames, allowing unauthorized access to memory beyond allocated buffers. ([windowsforum.com](https://windowsforum.com/security-alerts.84/cve-2026-16002-lib60870-2-4-1-fixes-scada-denial-of-service-risk.440185/?utm_source=openai)) Given the widespread deployment of lib60870 in critical infrastructure sectors such as energy, water, and manufacturing, these vulnerabilities pose significant operational risks. Organizations are urged to update to version 2.4.1 or later to mitigate potential threats. ([windowsforum.com](https://windowsforum.com/security-alerts.84/cve-2026-16002-lib60870-2-4-1-fixes-scada-denial-of-service-risk.440185/?utm_source=openai))
1 month ago
Kill Chain
CISA Issues Alert on Iranian Cyber Actors Targeting U.S. Critical Infrastructure PLCs
In July 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert regarding Iranian-affiliated cyber actors targeting internet-connected programmable logic controllers (PLCs) within U.S. critical infrastructure sectors, including water and wastewater systems. These actors exploited vulnerabilities in PLCs from manufacturers such as Rockwell Automation, Schneider Electric, and Siemens, leading to operational disruptions and financial losses. The attackers manipulated data on human-machine interfaces (HMIs) and supervisory control and data acquisition (SCADA) displays, causing outages and misleading operators about system statuses. This incident underscores the escalating threat landscape where state-sponsored actors are increasingly focusing on industrial control systems. The expansion of targeted PLC brands highlights the need for organizations to reassess and fortify their operational technology (OT) security measures to prevent potential disruptions to essential services.
1 month ago
Kill Chain
Schneider Electric IGSS Vulnerability CVE-2026-12927: Critical Update Required
In July 2026, Schneider Electric disclosed a high-severity out-of-bounds write vulnerability (CVE-2026-12927) in its IGSS Definition module, versions 18.0.0.26124 and prior. Exploitation of this flaw could allow attackers to execute arbitrary code by importing a malicious CGF file, potentially leading to data loss and loss of control over the SCADA system. The vulnerability was reported by Michael Heinzl and has been addressed in version 18.0.0.26125 of the IGSS Definition module. ([se.com](https://www.se.com/ww/en/work/support/cybersecurity/security-notifications/?utm_source=openai)) This incident underscores the critical importance of timely software updates in industrial control systems. As cyber threats targeting SCADA systems become more sophisticated, organizations must prioritize patch management and adhere to cybersecurity best practices to safeguard operational technology environments.
1 month ago
Kill Chain
KT Corporation Fined $39 Million for Massive Data Breach
Between October 2024 and September 2025, KT Corporation, South Korea's largest telecommunications provider, experienced a significant data breach due to a compromised femtocell device. Attackers exploited a lost femtocell's valid authentication certificate to intercept sensitive customer data, including mobile phone numbers and authentication codes, leading to fraudulent micropayments totaling approximately $167,400. Additionally, in March 2024, 38 KT servers were infected with the BPFDoor malware, a stealthy Linux backdoor linked to the China-nexus Red Menshen espionage group, which remained undetected for over a year. This incident underscores the critical need for robust security measures in telecommunications infrastructure, especially concerning device authentication and network monitoring. The prolonged undetected presence of advanced malware like BPFDoor highlights the evolving sophistication of cyber threats targeting critical sectors.
1 month ago
Kill Chain
Minnesota Water Utilities Face Coordinated Cyberattacks in July 2026
In late July 2026, over 30 community water systems in Minnesota experienced a coordinated cyberattack targeting their operational technology (OT) systems. The attacks, occurring on July 26 and 27, led to temporary disruptions in water treatment and distribution processes. For instance, the City of Braham reported its water plant was taken offline due to a malicious cyberattack but managed to restore operations within hours. The Minnesota IT Services (MNIT) agency activated its cybersecurity incident response capabilities, collaborating with federal, state, local, Tribal, and private-sector partners to investigate and mitigate the incident. This incident underscores the escalating threats to critical infrastructure, particularly in the water sector. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has emphasized the importance of isolating key OT systems to ensure continuity of critical services during cyberattacks. ([cyber.gov.au](https://www.cyber.gov.au/business-government/secure-design/operational-technology-environments/ci-fortify/ci-fortify-advice-for-isolating-vital-systems?utm_source=openai))
1 month ago
Kill Chain
Coordinated Cyberattack Disrupts 30+ Minnesota Water Systems
In late July 2026, a coordinated cyberattack targeted operational technology at over 30 community water systems across Minnesota, leading to service disruptions in cities including Braham, Plymouth, South St. Paul, and Maple Plain. The attacks affected automated controls and communications, with Braham's water plant temporarily going offline. State and federal agencies, including Minnesota IT Services (MNIT), the Cybersecurity and Infrastructure Security Agency (CISA), and the Environmental Protection Agency (EPA), initiated a comprehensive response to contain the incidents and restore services. The attackers' methods and identities remain under investigation, with no confirmed attribution to date. This incident underscores the escalating threat to critical infrastructure, particularly water systems, from cyberattacks. The similarities between this attack and previous campaigns targeting industrial control systems highlight the urgent need for enhanced cybersecurity measures and vigilance in protecting essential services.
1 month ago
Kill Chain
Coordinated Cyberattack Disrupts Water Utilities in 30+ Minnesota Communities
In late July 2026, over 30 Minnesota communities experienced disruptions in their water and wastewater utilities due to a coordinated cyberattack targeting operational technology systems. Cities such as Braham and Plymouth reported incidents where water treatment plants and related infrastructure were temporarily taken offline. While the attacks did not compromise water quality, they highlighted vulnerabilities in critical infrastructure. This incident underscores the escalating threat posed by state-sponsored cyber actors targeting U.S. critical infrastructure. The Cybersecurity and Infrastructure Security Agency (CISA) had previously warned of Iranian-affiliated groups, like CyberAv3ngers, exploiting internet-connected operational technology devices, including programmable logic controllers. ([epa.gov](https://www.epa.gov/newsreleases/epa-fbi-cisa-nsa-issue-joint-cybersecurity-advisory-water-system-regarding-iranian?utm_source=openai))
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports