The FBI and the Environmental Protection Agency are warning that malicious cyber actors are targeting internet-connected equipment used by water and wastewater utilities, causing "operational disruptions" and raising concerns about the security of critical infrastructure.

In a public service announcement, the agencies said cyber actors are targeting internet-facing programmable logic controllers (PLCs), including certain Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 series devices.

“The FBI is aware of malicious cyber actors targeting internet-facing programmable logic controllers (PLCs) associated with the Water and Wastewater Systems (WWS) Sector,” the alert said. 

According to the release, attackers have remotely accessed vulnerable devices, changed passwords and IP addresses, modified controller settings and, in some cases, interrupted normal operations. Federal officials said the activity has affected water and wastewater systems in multiple states.

The FBI and EPA warned that exposing operational technology directly to the internet creates unnecessary risk. “Cyber actors exploit these devices because they are internet accessible and often use default credentials or outdated software,” the agencies said.

Officials urged utilities to take immediate steps to reduce their exposure, including disconnecting devices from the public internet "whenever possible."