Micro-Comm, based in Olathe, Kansas, develops technology intended to monitor and control industrial processes. Among its products are programmable logic controllers, known as PLCs, devices that allow machinery and different automated operations to be controlled. These devices can be used in facilities related to water treatment and distribution, so a cyberattack against their manufacturer can raise concerns that go beyond the company itself. The information stored by a technology provider can also reveal details about the systems used by its customers and increase the potential impact of a cyberattack.<\/p>\n\n\n\n The intrusion was claimed by Barracuda, a relatively new ransomware group that claims to have an economic motivation and not to act on behalf of a government. The group published files that it attributed to Micro-Comm and claimed to have obtained hundreds of thousands of documents as a result of the cyberattack against the company. Micro-Comm stated that the published files did not contain the passwords or credentials used to remotely access its customers\u2019 devices. Despite this, it recommended that its customers change their passwords as a precautionary measure while the investigation into the cyberattack continued.<\/p>\n\n\n\n The timing of the cyberattack increased the authorities\u2019 interest. The intrusion took place while the United States was investigating other cyberattacks against water and wastewater systems, some of them related to actors that authorities link to Iran. However, the FBI indicated that the cyberattack against Micro-Comm appeared to be opportunistic and not an attack specifically designed against the company. This distinction is fundamental because the coincidence in timing between several cyberattacks does not demonstrate that different incidents have the same perpetrator.<\/p>\n\n\n\n PLCs are computer devices designed to control physical processes. They can receive information from sensors and transmit instructions to pumps, valves, motors, and other components used in industrial facilities. In a water or wastewater plant, these systems can form part of the operations responsible for maintaining certain levels, pressures, and treatment processes. For this reason, compromising a PLC through a cyberattack can have consequences that go beyond conventional information theft and turn a digital threat into an operational problem.<\/p>\n\n\n\n Industrial systems also have characteristics that differ from the computer networks used in offices. A corporate computer can store documents, emails, or databases, while a PLC can participate directly in a physical operation. If an attacker modifies certain parameters during a cyberattack, they can alter the way equipment operates or prevent operators from using it normally. In some recent incidents, facility operators had to disconnect equipment and temporarily resort to manual procedures to respond to the cyberattack.<\/p>\n\n\n\n This situation explains the concern of U.S. authorities about PLCs directly connected to the internet. During 2026, cyberattacks against devices from different manufacturers used in industrial sectors, including the water sector, were detected. Among the affected brands are major international providers of industrial technology, whose equipment is also present in energy, manufacturing, and critical infrastructure facilities. The variety of manufacturers demonstrates that the problem of cyberattacks does not depend on a single company or a single device model.<\/p>\n\n\n\n The scale of the threat became clear when U.S. authorities reported that they had observed cyberattacks against more than 100 internet-exposed systems belonging to the water and wastewater sector during July 2026. The targets included facilities that used PLCs to control industrial processes. The figure is particularly relevant because it demonstrates that attackers can seek numerous targets simultaneously and use a cyberattack as a way to attempt to access essential systems. The problem, therefore, is not limited to a specific facility but affects infrastructure distributed throughout the country.<\/p>\n\n\n\n Minnesota was one of the states that experienced a considerable number of incidents during that wave of cyberattacks. More than 30 water systems in the state were affected by problems related to their technological systems, and some operators had to adopt emergency measures. In certain cases, manual operations were used while control of the digital systems was being restored after the cyberattack. Nevertheless, the known incidents have not demonstrated widespread contamination of drinking water as a result of this campaign.<\/p>\n\n\n\n One of the factors that facilitated some of these cyberattacks was the exposure of industrial equipment to the internet. A directly connected device can be located by attackers searching for vulnerable systems without first needing to penetrate a conventional corporate network. Once the equipment is found, they can attempt to exploit weak passwords, incorrect configurations, or other vulnerabilities to initiate a cyberattack. For this reason, one of the main recommendations from the authorities is to remove industrial devices that do not need to be publicly accessible from the internet and thereby reduce the possibilities of new cyberattacks.<\/p>\n\n\n\n The attacks against water facilities took place in a context of growing concern in the United States about cyber operations associated with Iran. During 2026, U.S. agencies issued several warnings about actors affiliated with that country who were seeking to access operational technology systems used by critical infrastructure. Among the equipment that received particular attention were certain PLCs used in industrial facilities, which could become targets of a cyberattack. The water sector acquired particular relevance because of the number of small and distributed systems that exist in the United States and their potential exposure to this type of cyberattack.<\/p>\n\n\n\n However, attributing a cyberattack to a specific government is a complex task. Attackers can use servers belonging to third parties, publicly available tools, and different mechanisms to conceal their true origin. Therefore, an investigation into a cyberattack may require weeks or months before reaching a conclusion with a sufficient level of confidence. The existence of similar techniques between different attacks also does not necessarily mean that the same group is behind every cyberattack.<\/p>\n\n\n\n This caution is particularly important when analyzing the Micro-Comm case. Although the attack occurred during the same period in which intrusions against water facilities were being investigated, the information known points to an opportunistic ransomware attack. Barracuda has presented itself as a financially motivated group and not as a state-sponsored organization, so the cyberattack against Micro-Comm should not automatically be linked to Iran. Therefore, there is insufficient basis to state that the attack against Micro-Comm was part of the cyberattack campaign attributed to actors linked to Iran.<\/p>\n\n\n\n One of the main lessons from the recent attacks is that industrial systems should not be unnecessarily exposed to the internet. For years, many facilities operated with relatively isolated networks, but the need to manage equipment remotely has increased the use of remote connections. These connections make it possible to save time and money, since technicians can monitor certain systems without physically traveling to the facilities. However, each additional connection can also create a new attack surface and potentially facilitate a cyberattack.<\/p>\n\n\n\n The problem can be especially serious for small municipal facilities. Many communities have limited budgets and do not have large teams specialized in cybersecurity. Some also depend on external companies to install, update, or manage their industrial systems, which can increase the risks in the event of a cyberattack. When infrastructure of this type is exposed, an apparently small vulnerability can provide an attacker with a way to interfere with important systems.<\/p>\n\n\n\n Recent attacks also show that cybercriminals do not always need to use extraordinarily sophisticated methods. Finding an accessible device, identifying a vulnerable configuration, and taking advantage of weak credentials may be enough to initiate a cyberattack. The possibility of automating the search for exposed systems also makes it possible to analyze large numbers of targets in a short time. This turns an individual misconfiguration into a potentially repeatable problem on a national scale and makes it easier for the same group to attempt multiple cyberattacks.<\/p>\n\n\n\n The exposure of industrial systems is joined by another factor that is transforming the cybersecurity landscape: artificial intelligence. During August 2026, U.S. authorities warned about the use of artificial intelligence tools by malicious actors to facilitate attacks against certain industrial systems. These tools can help analyze documentation, understand configurations, automate certain tasks, and accelerate code creation, elements that can facilitate a cyberattack. As a result, some operations that previously required specialized knowledge may become more accessible to less experienced groups.<\/p>\n\n\n\n This does not mean that artificial intelligence can control a water treatment plant by itself. The real risk lies in the ability of these tools to increase the speed and efficiency of attackers during a cyberattack. A person can use them to analyze large amounts of technical information in much less time or to automate repetitive tasks. In an environment where thousands of industrial devices are connected, this capability can have a considerable impact and facilitate the preparation of new cyberattacks.<\/p>\n\n\n\n Artificial intelligence can also be used to strengthen defenses against a cyberattack. Operators can use it to analyze logs, identify anomalous behavior, and detect signals that could go unnoticed by a human team. However, industrial facilities cannot be updated or modified as quickly as conventional computer systems. Security must combine new technological tools with physical procedures, access controls, and emergency plans to respond effectively to a cyberattack and limit its possible consequences on the operation of the facilities.<\/p>\n\n\n\n The cyberattack against Micro-Comm demonstrates that the security of critical infrastructure also depends on its supply chain. A treatment plant does not use only its own servers and equipment, but depends on manufacturers, maintenance companies, integrators, software developers, and remote service providers. Some of these actors may have access to technical documentation or information about the architecture of the systems. Therefore, compromising a provider through a cyberattack can become an indirect way of obtaining information about other targets.<\/p>\n\n\n\n Data theft can be significant even when attackers do not manage to directly control a facility. Among the files associated with the cyberattack against Micro-Comm were documents related to government customers, employee names, and technical material. This information does not demonstrate that the attackers could control the customers\u2019 water plants. However, it can help them understand what technology certain organizations use and provide clues for future operations or new cyberattacks.<\/p>\n\n\n\n This reality requires rethinking the way critical infrastructure is protected against a possible cyberattack. It is no longer enough to secure the perimeter of a plant and trust that all internal systems are protected. It is also necessary to assess the risks associated with suppliers and third parties that have access to technical information and that could become targets of a cyberattack. The security of a facility increasingly depends on the security of the entire ecosystem surrounding it.<\/p>\n\n\n\n The first measure is to know exactly which devices are connected to the internet. Organizations should identify their PLCs, monitoring systems, remote connections, and other operational technology components. They should also determine who can access them and why they need an external connection. Any equipment that does not require public access should be kept isolated from the internet to reduce the chances of suffering a cyberattack.<\/p>\n\n\n\n The second measure is to strengthen authentication and remote access mechanisms. Default or weak passwords should be eliminated, and access should be limited to the people who actually need it. It is also essential to separate administrative networks from those that control industrial processes. In this way, if a computer used for administrative tasks is compromised during a cyberattack, the attacker will have greater difficulty reaching the systems that physically control a facility.<\/p>\n\n\n\n The third measure is to have plans to continue operating during a digital emergency. Facilities must know how to operate manually if they temporarily lose their automated systems as a result of a cyberattack. They should also conduct exercises to determine whether operators can maintain services while equipment is being recovered. An organization that can temporarily operate without its digital systems has a greater chance of limiting the consequences of a cyberattack.<\/p>\n\n\n\n The attacks recorded during 2026 demonstrate that water cybersecurity has become a matter of public safety. Computer systems are no longer used only to manage documents or communications, but also to control essential physical processes. An intrusion or cyberattack can cause operational disruptions, force the use of manual procedures, and increase pressure on the workers responsible for maintaining the service. The severity of each cyberattack will depend on the systems affected and the operator\u2019s response capability.<\/p>\n\n\n\n The problem is not limited to the water sector either. The same types of PLCs and control systems are found in factories, energy facilities, transportation networks, and other essential infrastructure. A vulnerability that makes it possible to carry out a cyberattack against an industrial device can have applications against different sectors. For this reason, the lessons learned from cyberattacks against water facilities can prove useful for protecting other critical services.<\/p>\n\n\n\n The United States is thus facing a combination of threats with different motivations. Ransomware groups seek economic benefits through information theft and extortion, while state actors may pursue objectives of espionage, strategic preparation, or disruption. Both can exploit similar weaknesses, such as exposed systems, poor passwords, or poorly segmented networks, to carry out a cyberattack. Defense must take this diversity of adversaries into account and not focus solely on one type of cyberattack.<\/p>\n\n\n\n Cyberattacks against the water sector in the United States during 2026 have demonstrated that critical infrastructure is increasingly connected to the digital world. The Micro-Comm case reveals that even technology providers can become targets of a cyberattack and that the theft of technical information can generate risks for organizations that were not even directly attacked. At the same time, the more than 100 water systems identified as targets during July show that industrial devices exposed to the internet represent a considerable attack surface. The threat becomes even more complex with the emergence of artificial intelligence tools capable of accelerating certain malicious operations and facilitating new cyberattacks.<\/p>\n\n\n\n The main lesson is that protecting the water supply no longer consists solely of keeping pipes, pumping stations, and treatment plants secure. It is also necessary to protect PLCs, industrial networks, remote connections, monitoring systems, and the companies that provide these technologies against possible cyberattacks. Security must extend throughout the entire supply chain and combine digital measures with operational procedures that allow work to continue during an emergency. This preparedness will determine whether a computer intrusion remains limited to a technical incident or can turn into a crisis for a community.<\/p>\n\n\n\n For now, the known attacks have not caused a nationwide disruption to the water supply or widespread contamination. However, it would be a mistake to interpret the absence of a catastrophe as proof that the problem is minor. The incidents have demonstrated that vulnerable systems exist, that attackers can locate them, and that some industrial devices can be manipulated from the internet through a cyberattack. The real warning lies precisely there: the next cyberattack could find a less prepared facility and produce much greater consequences.<\/p>\n\n\n\n The challenge for the United States will be to close the digital doors before attackers find a way to turn a computer vulnerability into a problem that reaches homes directly. To reduce the risk of a cyberattack and strengthen the protection of digital systems, ITD Consulting offers specialized technology and cybersecurity services tailored to the needs of each organization. If you would like to learn how ITD Consulting can help you protect your company against a cyberattack, you can write to<\/strong> info@itdconsulting.com<\/strong><\/a>.<\/strong><\/p>","protected":false},"excerpt":{"rendered":" Ciberataques contra el sector del agua en Estados Unidos: La nueva amenaza para las infraestructuras cr\u00edticas. ITD Consulting te informa.<\/p>","protected":false},"author":5,"featured_media":36959,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[459,564,69,71,278,68],"class_list":["post-36955","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-noticias","tag-459","tag-agua","tag-ciberataque","tag-ciberseguridad","tag-eeuu","tag-seguridad"],"_links":{"self":[{"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/posts\/36955","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/comments?post=36955"}],"version-history":[{"count":1,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/posts\/36955\/revisions"}],"predecessor-version":[{"id":36960,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/posts\/36955\/revisions\/36960"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/media\/36959"}],"wp:attachment":[{"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/media?parent=36955"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/categories?post=36955"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/tags?post=36955"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"Ciberataque](\"https:\/\/itdconsulting.com\/wp-content\/uploads\/2026\/09\/itd-consulting-backup-acronis-vds-vps-ciberseguridad-microsoft-365-EEUU-agua-ciberataque-1-1024x683.webp\")
<\/figure>\n\n\n\nWhy Are PLCs So Important for Water Security?<\/strong><\/h2>\n\n\n\n
More Than 100 Water Systems Were Targeted in July<\/strong><\/h2>\n\n\n\n
The Possible Connection to Actors Linked to Iran<\/strong><\/h2>\n\n\n\n
The Danger of Systems Directly Connected to the Internet<\/strong><\/h2>\n\n\n\n
![\"ITD](\"https:\/\/itdconsulting.com\/wp-content\/uploads\/2026\/09\/itd-consulting-backup-acronis-vds-vps-ciberseguridad-microsoft-365-EEUU-agua-ciberataque-2-1024x576.webp\")
<\/figure>\n\n\n\nArtificial Intelligence Accelerates the Threat<\/strong><\/h2>\n\n\n\n
The Technology Provider Can Also Become a Target<\/strong><\/h2>\n\n\n\n
How Can Water Facilities Protect Themselves?<\/strong><\/h2>\n\n\n\n
A Threat Affecting All Critical Infrastructure<\/strong><\/h2>\n\n\n\n
![\"Ciberataques](\"https:\/\/itdconsulting.com\/wp-content\/uploads\/2026\/09\/itd-consulting-backup-acronis-vds-vps-ciberseguridad-microsoft-365-EEUU-agua-ciberataque-3-1024x683.webp\")
<\/figure>\n\n\n\n