CISA logged more than 100 compromised water systems in July, typically reached through cellular modems

A cellular modem bolted onto a controller years ago generates no traffic on the city network and shows up on no scan of one ^[11]. It does generate a line item. Every SIM a city pays for is listed on a carrier invoice, and in most municipalities accounts payable is the only department holding that list ^[12]. The FBI and the EPA point utilities toward isolated architectures for this equipment, with a private access point name at the top of their list ^[13], which is a carrier configuration change rather than a capital project.

The counts do not line up. If the more than 100 systems CISA logged for July sat inside the seven states that had reported to the FBI, that averages over 14 compromised systems per state ^[21]. Press accounts citing unnamed officials put a dozen states or more in scope ^[3]. The Clayton County pump station went down at 1 a.m. on July 27, the same day the FBI's reporting window opens ^[22], so the reporting started when the operational effects did rather than ahead of them. Across the sector the reported effects were operational, meaning lost visibility and in some cases lost function ^[8].

Mike Searight, Waco's former chief information officer, writing in CyberScoop, describes tracing a cabinet at one of the city's water treatment plants and finding the plant's controls on the network along with the branch library and the register at the municipal golf course, in a city of 145,000 where nobody had ever been asked to inventory what was on it ^[15]. Most of those systems sit outside IT on the org chart, each with its own budget, vendors and boss, and in his experience exactly one engineer per city understands the whole picture, which leaves when the engineer does ^[16]. His argument is that two decisions matter, who is accountable for the whole network and where the funding comes from, that neither is technical, and that both sit with city managers and councils and can be settled this fiscal year out of a budget request already in motion ^[14].

Nothing forces the reporting that would size this. Texas gives local governments 48 hours to report a security incident, but only where it involves a personal-information breach or ransomware, so seizing control of a controller falls outside the trigger ^[17]. The federal 72-hour covered-incident rule was supposed to be finalized in October 2025, and Searight writes that CISA is now targeting this month ^[18]. On the money side, the Texas Water Development Board added cybersecurity to the scoring criteria in its State Fiscal Year 2026 Intended Use Plan for the drinking water revolving fund ^[19].

The editor's note attached to the piece says Waco bought network segmentation technology from Elisity while Searight was CIO and that he is now a senior adviser to Elisity ^[20]. Weigh that against the argument he makes: segmenting the city network would not have caught July's exposure ^[11], and the control he prescribes is a free reconciliation between accounts payable and the plant floor ^[12].