CISA Urges Utilities to Remove Internet-Exposed PLCs After Minnesota Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert following coordinated cyberattacks on over 30 community water utilities in Minnesota. The attacks involved threat actors targeting internet-exposed Programmable Logic Controllers (PLCs), modifying passwords to lock out operators, and changing IP addresses to disconnect devices. CISA's updated advisory now includes Schneider Electric and Siemens devices, and notes attackers are stealing PLC project files for reconnaissance.