Critical-Infrastructure
The Modem Nobody Audited: Inside the 2026 Water Utility PLC Attacks
Thirty-plus Minnesota water utilities lost control of their PLCs in a single weekend, and the entry point wasn't the internet-facing HMI everyone scans for — it was a cellular modem nobody put on the asset inventory. A look at what CyberAv3ngers actually did, why a 2021 CVE is still unpatched, and why 'get it off the internet' misses the real exposure.
First-of-Its-Kind Attack Pivots Through a Private Cellular APN to Sabotage Siemens PLCs at a Polish Power Plant
CERT Polska details a December 2025 attack that pivoted through a distribution operator's private cellular APN — from a compromised wind farm firewall to Siemens PLCs at a combined heat and power plant, halting a turbine.
Coordinated Attack Hits 30+ Minnesota Water Utilities, Knocks a Treatment Plant Offline
A coordinated attack on internet-exposed PLCs disrupted water and wastewater operations in more than 30 Minnesota communities on July 26-27, forcing manual control at multiple plants.
Ransomware Halts US Production at Coca-Cola's Fairlife Dairy Unit
A ransomware intrusion at Coca-Cola-owned Fairlife forced a shutdown of US dairy production lines, disclosed via SEC 8-K filing — no gang has claimed the attack and no ransom demand has been confirmed publicly.
AA26-194A: NSA, CISA, FBI Warn Russian FSB Center 16 Is Harvesting Router Configs via Weak SNMP and an 18-Year-Old Cisco CSRF Bug
A 19-agency joint advisory (AA26-194A) details a years-long Russian FSB Center 16 campaign that scans for default SNMP community strings and an 18-year-old Cisco IOS CSRF flaw (CVE-2008-4128, now in CISA KEV) to exfiltrate router configs and pivot into critical infrastructure.
AssuranceAmerica Breach Exposes 7 Million Driver's Licenses After a Single Phished Employee Account
A single compromised employee credential at auto insurer AssuranceAmerica led to the theft of driver's license numbers, SSNs, and policy data for nearly 7 million people — one of the largest driver's-license breaches disclosed in the US this year.
Accenture Confirms Breach After Threat Actor '888' Lists 35GB of Source Code and Azure Credentials for Sale
A threat actor known as 888 is selling 35GB of alleged Accenture source code, RSA/SSH keys, and Azure access tokens on a cybercrime forum; Accenture has confirmed an incident but not disclosed the access vector.
DHS Confirms Breach of HSIN, the Federal-State-Local Information-Sharing Backbone
DHS confirms an unattributed threat actor breached HSIN and a connected SharePoint environment used by fusion centers and law enforcement nationwide, with the intrusion window overlapping World Cup security planning.
CISA and the FBI Warn: Internet-Exposed Fuel Tank Gauges Are Under Active Attack
A June 2 joint advisory from CISA, the FBI, the NSA and five other agencies says attackers are compromising internet-exposed automatic tank gauge systems and modifying them through command execution. Shadowserver counts over 1,000 exposed, 909 in the US — on the same TCP port these consoles have answered on for a decade.
Itron Discloses Internal Network Breach: Smart Meter and Grid Software Vendor Reports Unauthorized System Access
Itron, a major U.S. supplier of smart metering and grid management software for electricity, water, and gas utilities, disclosed in an SEC 8-K filing that an unauthorized third party gained access to its internal IT network on April 13, 2026.
ZionSiphon: OT Sabotage Malware Targeting Israeli Water and Desalination Plants
Darktrace dissects ZionSiphon, a politically motivated OT malware built to tamper with chlorine and pressure in Israeli water systems. Broken by bad crypto, but the blueprint is real.
CISA AA26-097A: CyberAv3ngers Exploit Rockwell PLCs Across US Water, Energy, and Government Systems
Six US agencies issue joint advisory after Iranian-affiliated CyberAv3ngers compromise Rockwell Allen-Bradley PLCs in water, energy, and government sectors, manipulating SCADA displays and control logic.
Ransomware Hits Minot Water Treatment Plant SCADA System, FBI Investigating
Ransomware compromised the SCADA server at Minot, North Dakota's water treatment plant, forcing 16 hours of manual operations. FBI released a statement today confirming active investigation.