U.S. Warns Siemens Controllers Are Hackable as Iran Suspicions Grow Around Water-Plant Breaches

U.S. CYBERSECURITY AGENCIES warned Wednesday that unidentified hackers are trying to breach Siemens industrial controllers used to operate water facilities and other critical infrastructure, exposing essential services to potential disruption and physical damage.

The joint cybersecurity advisory describes an “active threat” to every Siemens S7 Series programmable logic controller. The devices are deployed across manufacturing, energy, water and wastewater, chemical, food and agriculture operations.

The National Security Agency, FBI, Department of Energy, Environmental Protection Agency and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency issued the warning.

Programmable logic controllers monitor equipment and direct industrial processes. A successful intrusion can reach the machinery and operations those devices govern. Federal officials said a compromise could disrupt critical processes, cause safety incidents and downtime, damage equipment, expose sensitive information, produce compliance violations and trigger failures across interconnected systems.

The hackers are using artificial intelligence to sharply reduce the expertise and development time needed to create working exploits, according to the advisory. That capability lowers the technical barrier to attacks against equipment responsible for maintaining physical operations.

The alert follows cyber incidents involving local water systems in several states. Cybersecurity experts suspect Iran-linked hackers may be responsible for the recent activity.

CISA reported a “significant increase” in cyberthreat actors targeting water and wastewater controllers on July 30. Eight days earlier, federal agencies had expanded an existing warning about Iranian-affiliated hackers exploiting programmable logic controllers made by Siemens, Rockwell Automation and Schneider Electric.

Minnesota was the first state to report a broad wave of attacks. More than 30 community water systems were targeted on July 26 and July 27.

Federal officials have not formally attributed the recent attacks on local water systems to Iran. President Donald Trump said on July 31 that he did not believe Iran was responsible and blamed Minnesota.

Siemens did not immediately respond to a request for comment.

Press freedom does not survive on vibes. It survives because readers decide the work is worth protecting. The Developer is independent, ad-free, and reader-funded—which means your support goes directly into the reporting, not into some billionaire’s pocket. If my work helps you stay informed, consider upgrading to paid: $8/month or $80/year. If upgrading isn’t possible right now, sharing The Developer with someone who needs to read it matters just as much. Help keep independent journalism alive and impossible to buy.