None of the Minnesota attacks needed an exploit. They needed a controller that answered.
On July 26–27, 2026, more than 30 Minnesota water and wastewater systems were hit in a coordinated attack, and utilities in other states reported incidents too. The same weakness is still open in thousands of small systems. Get the free two-page checklist for closing it, sent straight to your phone.
Free. No forms, no sales call required. Or text (408) 758-8444.
Sources: Minnesota IT Services statewide response; CISA advisory AA26-097A (published Apr 7, 2026, updated Jul 22, 2026); public reporting, July–August 2026. Figures were current as of August 2026.
Your existing defenses weren't built for this attack
The attackers scanned for controllers that answered from the public internet, then logged in with the same software your integrator uses. That's why the usual tools stayed quiet.
There was nothing to patch
No vulnerability and no CVE. They connected with standard PLC programming tools. A clean patch report didn't help.
It looked like maintenance
Vendor protocol from vendor software looks like normal engineering work, often with default passwords. There was no anomaly to flag.
They didn't use your remote access
The attackers skipped the VPN entirely and went straight to the controllers. Strong MFA on the front door didn't matter.
The target was still visible
Cellular modems at wells and lift stations sit outside the firewall, and rules drift toward "allow all" when nobody owns them. If it can be found, it can be targeted.
Assess. Block. Keep it that way.
A plain-language plan for utilities with no dedicated security staff. It follows CISA's own first mitigation, which most utilities still haven't done.
Assess: the first two weeks
- Sign up for CISA's no-cost external scanning
- Scan yourself the same day
- List every path in, not just every device
- Read the firewall rules nobody owns
Block: remove discoverability
- Priority 1: PLCs reachable from the internet
- Priority 2: cellular wells and lift stations
- Priority 3: vendor and integrator access
- Priority 4: SCADA/HMI reachable from office IT
Continuous: keep it that way
- Monitor what remains, and buy it as a service
- Give integrators identity-based, time-limited access with no shared passwords
- Re-scan quarterly and after every change
Three common reactions that waste time and budget
Wait it out
"We're too small" and "we've never been hit" were true for most of the Minnesota systems, until that weekend.
Copy a big-city IT stack
Fourteen firewalls, five consoles and five renewal dates don't suit a utility with no security staff, and they still leave the target visible.
Chase every CVE
A 4,000-line vulnerability report causes panic, not progress. Remove reachability first, and the backlog stops setting your schedule.
What works is simple, fast, affordable and effective, and it sits on top of the network you already run, with no new PLCs, no re-IP project and no extra headcount.
Most of this can be funded, and some of it is free
Small systems are getting grants that cover assessment and remediation. The key is having the assessment written down in a form a funder recognizes.
Free scanning
CISA scans your external address space weekly at no cost, with no contract.
Free membership
WaterISAC is free for systems serving 10,000 people or fewer, and that includes briefings and fundamentals.
State revolving funds
DWSRF/CWSRF set-asides can fund the assessment, and the loan fund can fund the build.
State grants
New York's SECURE program funded implementations from about $15K to $308K in 2026.
One point of contact, from the first text to a protected plant
I'm Coralyn Vega. I connect water and wastewater utilities with vetted OT security specialists: assessment teams that also write grant applications, and technology that hides control systems from internet scans without re-engineering your network.
Message me
Send a text and I'll send the checklist back the same day.
A short call, if you want one
Fifteen minutes on your sites, your remote access and your funding options. You don't have to share anything you're not comfortable with.
The right introduction
If it makes sense, I introduce you to a specialist who fits your size and budget, and I stay your point of contact.
Tell me a little about your system, and I'll send the checklist to your phone
Every field is optional. Tapping the button opens your text app with a message already written, and you just press send.
Straight answers
Is the checklist really free?
Yes. It's free, with no obligation, and it's useful on its own. Most of the first two weeks uses free tools from CISA and others.
Who is this for?
Water and wastewater utilities of any size, especially small and rural systems with no dedicated security staff. It also works for the integrators, engineers and board members who support them.
Do we need to replace our PLCs or redesign our network?
No. The fix for this kind of attack is to stop your controllers from answering unknown traffic. That can be layered over the network you already run, with no new PLCs, no re-addressing and no firmware changes.
What does fixing it cost?
It depends on how many sites you have, but it's usually far less than a traditional firewall-at-every-site project, and grants often cover the assessment and much of the build. I'll point you to the funding sources that fit your state.
We already have a firewall and a VPN. Aren't we covered?
Maybe not. In Minnesota, controllers were reached directly, often over cellular links that bypass the plant firewall. The checklist shows how to confirm what an outsider can see.
What happens to my information?
This site doesn't collect or store anything. The only details I receive are the ones you choose to send in your text message, and I use them only to reply to you and, with your permission, to make an introduction.
The checklist is general guidance based on public CISA and WaterISAC material. It isn't a substitute for an assessment of your own environment. Coralyn Vega Consulting refers clients to independent, vetted technology and service providers and may receive referral compensation. You always contract with those providers directly.
