US Agencies Warn That Iranian Hackers Are Targeting Industrial Control Systems Made by Siemens, Schneider Electric, and Rockwell Automation
An updated federal advisory names the specific techniques used to break into programmable logic controllers, the computers that run factories, water plants, and power grids.
Key points
- US federal agencies issued an updated advisory warning that Iranian state-linked hackers are actively targeting industrial control systems made by Siemens, Schneider Electric, and Rockwell Automation.
- The hackers are focused on programmable logic controllers (PLCs), small specialised computers that directly operate physical machinery in factories, water-treatment plants, and energy facilities.
- The advisory names the specific techniques the hackers use to break into these devices.
- No single breach date is given; the advisory treats this as an ongoing, active threat.
Federal agencies have updated a standing advisory to warn that hackers linked to Iran are targeting industrial control systems. The advisory, first covered by SecurityWeek, names Siemens, Schneider Electric, and Rockwell Automation as manufacturers whose equipment is under active attack.
At the centre of the warning are programmable logic controllers, or PLCs. A PLC is a small, ruggedised computer bolted to a factory floor or inside a water-treatment facility. It sends direct commands to pumps, valves, and circuit breakers. Whoever controls a compromised PLC can, in the worst case, cause physical damage or interrupt services that people depend on.
Why does this matter to people who don't work in a factory?
PLCs sit inside the systems that treat drinking water, route electricity, and keep pharmaceutical production lines moving. Disrupting one doesn't stay inside a corporate network. Consequences can reach hospital wards and food supply chains alike.
The updated advisory describes what the hackers do once they find a PLC reachable from the internet, with enough technical detail for engineers and security teams to check their own networks for matching signs. All three manufacturers named here have been under close scrutiny: our 15 July story covered a wave of patches these same companies pushed for their factory-control software, and the sequence from patched flaws to active targeting by a state-linked actor is exactly the pattern that makes advisories like this one worth reading carefully.
This sits firmly inside the regulatory spotlight. The Cybersecurity and Infrastructure Security Agency (CISA) is the federal body responsible for critical-infrastructure warnings. Under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), operators will eventually face mandatory reporting deadlines when incidents like these occur. The final CIRCIA rulemaking is still pending, but advisories like this one feed directly into the compliance picture regulators are assembling.
Should you worry if you run one of these facilities?
Facility operators should treat this as a prompt to verify whether any PLCs from the three named manufacturers are reachable from the open internet without a firewall, or still carry factory-default passwords, the login credentials set by the manufacturer before a device ships and which attackers routinely exploit. Those two checks cost little and close the most common entry points the advisory describes.
For the public, the practical point is blunt: if a local utility reports an unexplained disruption in the weeks ahead, this advisory explains what may be driving it.
