CISA finally counts the water intrusions: 100-plus exposed systems behind cellular modems

A programmable logic controller with its own cellular modem answers to a carrier network rather than to anything the IT department fronts, and CISA says that is the path the July activity commonly took ^[2]. The guidance does not say how those links came to exist. It says only that leaving PLCs and other industrial control systems reachable by cellular modem or the public internet is what enabled the activity against water and wastewater utilities ^[10].

The order of CISA's advice is the tell. It begins with identifying every internet-accessible system through internal inventories and external scanning, and only then asks which of those exposures operations actually require ^[8]. Everything that follows, including default password changes, security updates, remote access through gateways or jump hosts, multifactor authentication and traffic monitoring, applies to assets an operator already knows it owns ^[9]. An agency confident that water utilities held that list would not have led with building it.

The published arithmetic is thin in a specific way. Over 100 systems ^[1] spread across the at least 12 states the report places in scope ^[5] averages about eight per state ^[14]. Six states have confirmed publicly that they were targeted ^[6], which leaves at least six affected states unnamed in the public record ^[13]. Both figures are floors, so the per-state number is a shape rather than a measurement, and there is no published breakdown by utility size to tell whether the exposure sits mostly in small unstaffed sites.

Attribution and intent come from the same reporting: activity linked to Iranian threat actors, aimed at disrupting operational technology ^[3]. No significant disruption resulted ^[4], which describes an outcome and not the reach. The distinction matters because the remediation CISA is asking for does not depend on the intruders having done anything at all. A controller answering the public internet is the finding. This also arrived on the heels of CISA warnings about Iran-linked attacks on ICS built by Siemens, Schneider Electric and Rockwell Automation ^[11], so the vendor advisories and the exposure advisory are pointing at the same equipment population from opposite ends.

The last line of the guidance is the one utilities will find most expensive: reassess regularly, because networks and third-party connections keep changing ^[12]. That reframes internet exposure as a condition that returns whenever an integrator, a contractor or a maintenance visit adds a link, not a defect that a single scan retires. Water systems that treat this as a one-time cleanup will produce a clean inventory and then drift away from it, and the next count will be someone else's number to publish.