Incident Response

Federal and state authorities are investigating a series of coordinated cyberattacks targeting drinking and wastewater treatment facilities across the U.S. Threat groups with suspected links to Iran have targeted vulnerable programmable logic controllers, the devices used to monitor and control various industrial systems, including those of water utilities. 

Utilities in at least 12 states were impacted by the attacks, including Minnesota, Michigan, Georgia, South Dakota and New Jersey. 

The first public discovery of the threat began in Minnesota, where more than 30 community water systems were targeted in a “coordinated attack” from July 26-27. Hackers hit PLCs as well as human machine interfaces, the dashboards for monitoring water levels or temperatures. 

Officials in South St. Paul, Plymouth, Maple Plain and Braham have confirmed they were attacked, but stated that water safety was not affected.

In Georgia, the Clayton County Water Authority said an attack on July 27 briefly disrupted its OT systems. Officials issued a boil water advisory and restored service within a few hours after testing confirmed the water supply was safe. 

Authorities in New Jersey responded to two confirmed cyber incidents in July and have been working with the affected utilities, along with the FBI and CISA. Both of the incidents involved vulnerable internet-exposed devices, which temporarily prevented operators from monitoring or managing them remotely. 

“In both cases, staff shifted quickly to manual operations, and there was no disruption to service,” a spokesperson for the NJ Office of Homeland Security and Preparedness told Cybersecurity Dive. “Customers had uninterrupted access to safe drinking water throughout.”

Vulnerable PLC devices

The attacks began days after CISA and the FBI issued a July warning about expanded targeting of vulnerable PLCs in the water and energy sectors. Hackers originally began targeting PLCs made by Rockwell Automation in the early weeks of the Iran war, and in recent months expanded their attacks to Schneider Electric and Siemens PLCs.

Rockwell Automation in March issued an updated warning about a legacy authentication bypass vulnerability tracked as CVE-2021-22681 in its Studio 5000 Logix Designer software. If exploited, the flaw could allow an attacker to use an unauthorized third-party tool to alter the configuration of a Logix controller. 

Among these newly targeted devices were the Schneider Electric BMX P34/Modicon M340 PLCs, as well as the Siemens S7-1200 series PLCs. U.S. authorities on Aug. 19 warned of a wider campaign of AI-enabled hackers targeting internet-exposed and out-of-service Siemens S7 series devices across multiple industries, including water. 

Hacktivist attacks

The threat against water systems is not a new phenomenon. Iran-nexus adversaries, for example, have been targeting water systems in Israel and the U.S. since the launch of the Gaza war in 2023. CyberAv3ngers, a group backed by the Islamic Revolutionary Guard Corps, targeted vulnerable Unitronics PLCs in multiple cyberattacks across the U.S.

The Biden administration engaged with state and local officials in an attempt to strengthen water utility security. A 2024 investigation by the EPA’s Office of Inspector General uncovered vulnerabilities in hundreds of water utilities across the country. 

Multiple initiatives were made to provide assistance to rural water systems, including DEF CON Franklin, which was supported by the National Rural Water Association and the University of Chicago.

Iran-linked attacks against water and energy systems ramped up earlier in 2026 following the U.S. and Israeli bombing campaign in February. The FBI and CISA warned that the attacks led to operational disruption and financial losses. 

Authorities suspect Iran-nexus groups are behind the July attacks. However, questions emerged whether more than one group was involved: Minnesota officials called the attacks “coordinated” and said it was not clear whether all of the attacks were carried out by the same actor. 

Earlier in August 2026, a group called APT Iran claimed credit for the Minnesota attacks, saying it was working with CyberAv3ngers, according to Check Point Research. The hackers made additional claims, saying they had access to power grids and telecommunications systems as well.

Calls for cyber oversight

Federal authorities and industry groups now are collectively pushing for greater oversight and additional resources to help prevent additional attacks against water utilities. The EPA held a conference call with hundreds of stakeholders in the water industry in late July, and key industry groups are pushing for new legislation. 

The National Association of Water Companies is urging Congress to pass bipartisan legislation to create a water risk and resilience organization that would advise the EPA on developing uniform cybersecurity standards. NAWC officials said such an organization should operate similar to the North American Electric Reliability Corp., which helps regulate the power industry.

“We need to be collaborating more than ever,” Robert Powelson, president and CEO of NAWC, told Cybersecurity Dive. “None of us should be exempt from meeting compliance standards.”

The American Water Works Association sent a letter to House and Senate leaders urging similar support, including additional funding, additional eligibility for cybersecurity training and improved information sharing. 

Various states have taken immediate action to address the heightened risks to community water systems. Earlier in August 2026, New York Gov. Kathy Hochul announced $9 million in grants to better protect water facilities. The grants would be available for Tier 1 improvements like penetration testing and risk assessments or Tier 2 improvements, including firewalls, network segmentation and incident response plans. 

A source familiar with the grant program said New York was not among states impacted by the recent cyberattacks. 

Defense in Depth

As federal authorities continue to investigate and industry leaders push Congress on new legislation, frontline water system operators have to make real-time decisions about how to protect their systems from immediate threats. 

The July attacks led to temporary disruptions at many of the impacted utilities, leading to the loss of water pressure and flooding in certain cases. Thus far, operators were able to avoid more catastrophic impacts.

“Some of what I think the adversaries are trying to achieve here is just a fear factor,” Ryan Whelan, managing director and head of cyber intelligence at Accenture. 

Federal officials and PLC vendors have been urging water utility companies to harden their environments with multifactor authentication, remove devices from the open internet, change complex passwords and replace end-of-life software to supported versions. 

Firewalls should be configured to limit access to PLCs and device switches should remain in the “run” position and only switched to “remote” or “program” positions when downloading software or updating existing applications, according to the CISA and FBI advisory. 

OT experts, meanwhile, advise utilities to take a hard look at their entire network and secure every potential entry point. 

“That means approaching the environment like an attacker would,” said Harry Thomas, CTO and co-founder of OT security firm Frenos. “Identifying every path into the control system, determining which paths lead to PLCs and other operational crown jewels, and finding the places where one compromised credential, vendor connection or cellular modem could bypass multiple layers of defense.”

Klue, a provider of a market intelligence platform, is investigating a supply chain attack that led to the mass exfiltration of Salesforce customer relationship management data belonging to hundreds of customers, including several prominent cybersecurity firms. 

A threat actor used a compromised Klue Battlecards app to gain access to OAuth tokens for connecting Klue with third-party integrations, including Salesforce, according to information from Klue and security researchers at Reliaquest, which warned about the attack in a recent blog post. 

Salesforce, which disabled connections through the Klue Battlecards app until further notice, said there is no indication of a vulnerability within its own platform. 

A threat actor tracked as Icarus posted stolen data from several victims on its website, according to a June 18 blog post from Huntress. Itself a victim of the attack, Huntress said none of its internal systems were impacted.

The threat group has begun reaching out to companies whose customer data was compromised in the attack, said Charles Carmakal, CTO at Mandiant Consulting. 

Security firms impacted

Several other security companies, including LastPass, Recorded Future and Tanium, confirmed that hackers accessed certain customer data and said they have since revoked their integrations with the Klue app. 

LastPass, a firm that provides a password management app for consumer and enterprise users, said attackers gained access to standard CRM data, including names, emails, physical addresses, phone numbers and support-case data and sales-related information. 

There is no evidence the attack affected LastPass products, services or infrastructure. Klue OAuth tokens have since been rotated. 

Tanium confirmed that business contact information, including names, business addresses, job titles, email addresses and social media handles might have been stolen. In a blog post, Tanium said its own products and cloud infrastructure were unaffected.

Recorded Future officials said hackers were able to gain access to client contact names and email addresses stored within its Salesforce database, according to a blog post, and some information regarding business contracts might have been affected. There was no impact to Recorded Future’s core platform or any internal infrastructure. 

Klue has retained CrowdStrike and is conducting a thorough review of all of its security controls, credential management, monitoring and deployment processes. There is no indication that customer data stored within the Klue platform was impacted by the attack. 

Sponsored content

By SentinelOne

Agentic AI is no longer theoretical. It’s already embedded across enterprises inside developer workflows, SaaS platforms, and operational pipelines. It is executing tasks, chaining actions, and interacting with critical systems at machine speed.

What makes this shift different from previous waves of automation is not just capability, it’s autonomy. These systems don’t wait for step-by-step human instruction. They interpret goals, break them into subtasks, and execute independently across tools, data, and environments. That autonomy is powerful, however it’s also introducing a new class of security challenges that traditional controls were never designed to handle.

Most organizations today lack visibility into where agents are running, what they can access, and what actions they’re taking. Even fewer have the ability to enforce policy or intervene in real time. As a result, agent adoption is accelerating faster than the security models required to govern it.

To adopt agentic AI safely, SentinelOne® is helping organizations rethink security from the ground up starting with how agents behave, what they can reach, and how their actions are controlled.

When AI Doesn’t Just Respond—It Acts

Agentic AI interactions have a technical distinction that fundamentally changes the security equation. Unlike traditional AI systems that generate outputs in response to prompts, agents are designed to execute. They receive a goal, decompose it into subtasks, and carry out actions across systems, often without per-step human approval. They hold credentials, make API calls, modify data, and interact with business-critical platforms in real time.

They can read files, execute code, send messages, and trigger workflows—all autonomously. This shift from “response” to “execution” introduces three distinct categories of risk.

1. Construction-Time Risk: How Agents Are Built

Many risks are introduced before an agent ever runs. Agents are often deployed with overly permissive IAM roles, granting access far beyond what their tasks require. They rely on third-party skills and plugins pulled from public repositories, creating a new supply chain surface with little verification. In many cases, API keys and secrets are hardcoded directly into configurations, making compromise trivial. At this stage, the issue is not behavior, it’s exposure.

2. Runtime Risk: What Happens When Agents Execute

Once deployed, agents introduce dynamic, real-time risks that traditional controls struggle to detect. Prompt injection attacks can manipulate agent behavior in ways that trigger real-world actions and not just incorrect outputs. A malicious instruction embedded in a document can become an execution command. Agents may also chain together individually authorized actions that, in sequence, produce unauthorized outcomes. Data exfiltration can occur through legitimate-looking API calls as part of “completing a task”. At runtime, the line between intended behavior and malicious activity becomes blurred.

3. Operational Risk: The Gaps Around the System

Even when risks are understood, most organizations lack the operational controls to respond effectively. There is often no kill switch to stop a misbehaving agent in seconds. No rollback capability to recover from corrupted data. No audit trail to reconstruct what an agent actually did. And no incident response playbook designed for machine-speed, autonomous actions. These gaps compound the risks introduced at every other stage.

As autonomous agents continue to move quickly from experimental tools to core infrastructure, security has lagged behind. Most frameworks still operate on implicit trust: trust in downloaded skills, trust in evolving prompts, and trust that agents will behave safely despite increasing autonomy. That assumption is already proving flawed.

Agentic AI is not slowing down. The organizations that succeed won’t be the ones that moved fastest or blocked adoption entirely—they’ll be the ones that built the visibility, control, and response capabilities to adopt it safely. The path forward is clear: See every agent, understand what it can reach, enforce what it’s allowed to do, and maintain a complete record of its actions. This is the governance layer agentic AI demands.

Disclaimer:

All third-party product names, logos, and brands mentioned in this publication are the property of their respective owners and are for identification purposes only. Use of these names, logos, and brands does not imply affiliation, endorsement, sponsorship, or association with the third party.

This publication includes forward-looking statements, including, but not limited to, statements concerning the expected timing of product and feature availability, the benefits and capabilities of our current and future products and services, competition and our competitive position, our strategic plans and objectives, and general market trends. Forward-looking statements are subject to risks and uncertainties, including factors beyond our control, that could cause actual performance or results to differ materially from those expressed in or suggested by the forward-looking statements. These and other risk factors are described in the “Risk Factors” section of our most recent Annual Report on Form 10-K, subsequently quarterly reports filed on Form 10-Q, and other filings made with the U.S. Securities and Exchange Commission (SEC), which are available free of charge on our website at http://investors.SentinelOne.com and on the SEC’s website at www.sec.gov.

More than three-quarters of cybersecurity leaders said their organizations have experienced a cyberattack in the past 12 months, a report released on April 9 from Sygnia showed. And 73% of the same respondents said they would not be adequately prepared to respond to a future incident. 

The report, based on a survey of 600 senior cybersecurity decision managers, highlights a readiness gap that has plagued organizations for years. The report shows that, despite 99% adoption rates of formal incident response plans, many organizations have continued gaps in execution. 

According to the report, there are three major issues that limit incident response capabilities: 

• Organizations have difficulties in coordinating key stakeholders in the case of an attack.
• There is limited involvement of top executives or board members in incident response readiness and decision-making.
• Legal and communications matters often delay critical decisions. 

In certain industries, such as healthcare, regulatory considerations frequently get in the way of a well-rehearsed incident response playbook. 

The report also showed that incident response is often impacted by visibility gaps, such as the use of public cloud or software as a service. 

A series of reports demonstrated major evolutions in how threat groups target and undertake cyberattacks. 

They have used AI and sophisticated planning to execute ransomware and other attacks faster than ever. Threat groups have also exploited weaknesses in SaaS platforms to launch attacks against supply chains of customers. 

Stryker is investigating a cyberattack that led to a global network disruption of its Microsoft environment.

In a statement posted on LinkedIn March 11, Stryker said it did not believe the attack involved ransomware or other malware and added that it believed the incident was contained.

“Our teams are working rapidly to understand the impact of the attack,” the company said. “Stryker has business continuity measures in place to continue to support our customers and partners. We are committed to transparency and will keep stakeholders informed as we know more.”

Stryker identified the cyberattack on March 11, and activated its cybersecurity response plan and launched an investigation with external advisors and cybersecurity experts, according to a filing with the Securities and Exchange Commission.

The full scope of the impact, including operational and financial effects, are not yet known. Stryker does not have a timeline for full restoration of its systems. The company has not determined whether the attack will have a material impact.

A spokesperson for Microsoft said the company did not have any immediate comment, but added they would get back in touch if there was any additional information.

Stryker, in a March 12 update posted to its website, said the company is working to restore its electronic ordering system as quickly as possible.

“We have visibility to the orders entered before the event, and they will be shipped as soon as our system communications are restored,” Stryker said in the statement. “Any orders that have come in after the event are being examined.”

Products like its Mako surgical robots, Vocera and LifePak35 monitor/defibrillator are fully safe to use, according to Stryker. It is also safe to communicate with company employees and sales representatives by email and phone.

Stryker, based in Portage, Michigan, is a medtech company that specializes in orthopedics, including manufacturing joint implants and surgical robots, as well as medical equipment like hospital beds.

The company has 56,000 employees and operates in 61 countries. Its revenue in 2025 totaled $25.1 billion.

According to a report from The Wall Street Journal, the attack led to a global outage across Stryker’s systems as the hackers remotely wiped remote devices running Microsoft’s Windows operating system, including cellphones and laptops.

Stryker told employees to disconnect from all networks and to not turn on company-issued devices, according to an email viewed by the Journal.

An Iran-linked threat actor that researchers call Handala claimed credit for the attack, according to a spokesperson for Check Point Research.

Handala is a group that masquerades as pro-Iranian hacktivists but is believed to be part of the Iranian Ministry of Intelligence and Security, according to Palo Alto Networks Unit 42.

The Stryker attack would represent a significant escalation for Handala, marking the first time it has targeted a major U.S. business, according to Check Point Research.

“The fact that they’ve set their sights on a major medical device company is particularly alarming,” said Sergey Shykevich, threat intelligence group manager at Check Point Research. “Critical healthcare infrastructure represents a high-value, high-impact target: disruption doesn’t just mean data loss, it can mean patient safety.”

Several hacktivist groups have claimed attacks against companies based in the Middle East since the U.S. and Israel’s war against Iran began in late February. An Iranian state-linked actor tracked as Seedworm, or MuddyWater, has targeted the networks of U.S. companies since early February, with researchers at Symantec and Carbon Black finding backdoors on the networks of multiple firms.

More than one-fifth of organizations running macOS networks have lost money or experienced a cyberattack because of their use of AI tools, according to a report that network management vendor Jamf released on June 15.

Roughly six in 10 macOS-based organizations expect an AI-related incident in the near future, the survey found. The report, based on interviews with 687 IT and security leaders managing MacOS network environments, also describes system administrators’ AI implementation priorities, the largest areas of risk they face and Jamf’s recommendations for mitigating those risks.

MacOS-based enterprises are overwhelmingly using AI, according to Jamf’s report, with roughly 73% reporting that they have deployed it already and another 20% exploring deployments. But network administrators overseeing the adoption of AI face a range of dangers.

The biggest and best-known risk is shadow AI, which refers to employees’ use of unapproved and ungoverned AI tools. When “IT is left in the dark about what AI systems are used,” that “lack of visibility makes security and governance difficult, if not impossible,” Jamf said.

Agentic AI is becoming popular within enterprises, but it carries risks, too. IT and security leaders said they struggled to deploy AI agents “in a way that enables users without putting data at risk,” according to the report. “With appropriate permissions, agentic AI opens serious risks to code bases if insecure or problematic code is added or necessary code is removed.”

The wide range of AI vendors also poses a problem for tech leaders in charge of acquisition. “Vetting and deploying each possible AI tool is time consuming and difficult for IT teams, especially at the speed AI is moving,” Jamf said in its report.

AI’s usage-based model also creates unwelcome surprises for organizations, a challenge magnified by a lack of governance that leaves IT supervisors unaware of how many paid licenses their organizations maintain and which tools are providing the best value for their cost.

Managing these challenges requires strong AI governance, but governance ranked third on survey respondents’ list of priorities, after automating their IT management activities and using AI to improve workers’ productivity. AI security improvements ranked fifth on the list.

Governance will become more pressing for organizations as they adopt AI more extensively. Jamf’s data highlights a correlation between the depth of an organization’s use of AI and the likelihood that it has experienced an AI-related incident. The incident rate among organizations exploring AI was less than 20%, the low end of the scale, while the rate among organizations that have “deeply integrated” AI into their workflows was 27%, the high end.

To tamp down on AI risk exposure, Jamf recommended that organizations expand visibility through regular audits, focus on software governance rather than user governance (including through carefully enforced data-access policies), integrate governance from the earliest possible deployment stage and use built-in tools whenever possible for the most streamlined experience.

A recent cybersecurity attack at Instructure ed tech company exposed certain student information, the ed tech company confirmed in a status update on its website on May 8, but added in a May 9 update that it believes the incident has been contained.

Information impacted by the data breach includes messages between users, names, email addresses and student ID numbers, according to Instructure. The company said no passwords, dates of birth, government identifiers, or financial information were believed to have been compromised as of May 9.

While Instructure said it is actively investigating the incident alongside forensics experts, the company has not disclosed how many school districts were affected.

Instructure, on its homepage, touts itself the “most-visited education website in the world.” The company operates several ed tech products for K-12 schools, including the widely used Canvas learning management system. 

Canvas has over 6 million “concurrent users,” according to Instructure’s website. Instructure did not explicitly say the breach had affected Canvas, but did report it was investigating disruptions to some Canvas tools and putting the learning management system under maintenance around the same time it announced the data breach. 

Upon request for comment and further details regarding the cybersecurity incident, Instructure told K-12 Dive in a May 5 email to check the company’s status page, where it said updates on the breach would be provided as they become available. 

In response to the incident, Instructure said on its status page, the company has revoked privileged credentials and access tokens related to the affected systems, deployed patches to increase system security, and heightened monitoring across all of its platforms. 

The incident at Instructure marks the latest known data breach for a large ed tech vendor with sweeping implications for districts’ sensitive student and staff data.    

Other recent high-profile cyberattacks targeted PowerSchool, a cloud-based K-12 software provider, and Illuminate Education, a student information system provider. 

A May 4 newsletter post by K12 Security Information eXchange, a K-12 cybersecurity nonprofit, said “small and medium businesses — including the majority of U.S. K-12 education software businesses — are frequent cybersecurity targets.” Some 59% of small and medium-sized enterprises experienced a cyberattack in the past year, according to research K12 SIX cited from Hiscox, an insurance company.

Ed tech companies are increasingly facing heightened accountability over cybersecurity from federal regulators and in the courts. In recent months, for example, the Federal Trade Commission reached a settlement with Illuminate over its 2021 data breach, while PowerSchool announced a $17.25 million settlement in the handling of student data on the Naviance platform. 

Although these cases are “likely to shape market behavior,” K12 SIX said, they “won’t do enough in and of themselves to stem the tide.”

Trellix disclosed an incident where an unauthorized party gained access to a portion of its source code repository, in a post on its corporate home page. 

The California-based cybersecurity firm, which serves more than 50,000 business and government customers, has retained outside forensic experts and notified law enforcement about the attack. 

An investigation found no evidence that source code has been released or of any impact on its distribution process. Trellix also confirmed there is no immediate indication of its source code being exploited. 

A Trellix spokesperson confirmed the details of the incident but did not respond to a request for additional details. 

Industry analysts warned that even without evidence of initial compromise, the incident highlights the potential near-term impacts on the software supply chain.

Access to the source code repository could offer valuable insight into a company’s detection logic, product architecture and engineering assumptions, Deepak Mishra, senior director analyst at Gartner, told Cybersecurity Dive. 

“Such knowledge is typically leveraged over time to refine evasion techniques, rather than drive immediate disruption,” Mishra added. “Importantly, at this stage, the absence of observed exploitation should not be interpreted as absence of risk, given the lag between exposure and downstream attacker use.”

Trellix was formed in late 2021 in the merger of McAfee Enterprise and FireEye. 

Trellix said it will share additional updates on the breach when the investigation is completed.