Iran-linked hackers took over American water systems just by changing a password

The article on firewalls already warned that opening a port is like drilling a permanent hole through a network's first line of defense. An attack campaign revealed in 2026 against American water systems shows what that advice, usually given to an individual, can cost at the scale of an entire piece of critical infrastructure.

What happened

The FBI and the US cybersecurity agency CISA warned repeatedly in 2026 of an attack campaign targeting industrial controllers (PLCs, for programmable logic controllers) used in the US water and energy sector, attributed to actors linked to Iran. Attacks clearly intensified starting in July 2026: Minnesota authorities reported that around 30 water systems in the state were targeted between July 26 and 27. The affected equipment includes controllers from several major industrial brands, including Rockwell Automation, Schneider Electric, and Siemens.

What a PLC is, and why it should never be exposed directly to the internet

An industrial controller, unlike an ordinary web server, directly controls a real physical process: here, opening valves, running pumps, actually treating water. Some of this equipment had been connected directly to the internet, often to allow convenient remote management, exactly the kind of exposure already discouraged in the article on firewalls: "never open a port without knowing precisely which service uses it, and close it again as soon as it's no longer needed." An industrial controller reachable from anywhere on the internet becomes, like any service exposed this way, directly scannable by automated tools that constantly sweep entire address ranges looking for this kind of target.

The attack itself: nothing sophisticated

Once access was gained, often through credentials left at their default value, never changed since the equipment was installed (see the article on passwords), the attackers remotely changed the controller's password as well as its IP address, locking the legitimate operators out of their own system. No complex technical flaw was needed to achieve this result: most of the work had already been done, long before the attack, simply by exposing the equipment directly to the internet.

The role of artificial intelligence in this campaign

US authorities stated that the attackers used artificial intelligence to automatically generate exploit scripts from public information available about the targeted controller models. This detail nicely illustrates the distinction drawn in the article on algorithms: artificial intelligence broke nothing new here: it simply sped up and made more accessible an already-known attack technique, lowering the technical skill bar needed to exploit it at scale.

Why this matters beyond computing

Unlike most incidents already covered on this site, such as a data breach or a cryptocurrency theft, this campaign directly touches a real physical process. An operator locked out of their own water treatment system isn't facing a simple, abstract IT problem: they lose, at least temporarily, their ability to monitor and adjust a process the public health and safety of the population they serve depends on directly.

What this actually changes

This campaign confirms, at the scale of an entire piece of critical infrastructure, a rule already stated several times on this site for individual use: never expose a service directly to the internet without precisely understanding the consequences, and never leave a default credential unchanged on a piece of equipment, no matter how specialized and far removed from the general public it may be. The official recommendation from US authorities following this campaign is, fittingly, strikingly simple: purely and simply remove these industrial controllers from direct internet access, the same underlying logic already recommended here, applied at an entirely different level of stakes.