Defend Against Active Threat to Siemens S7 Series PLCs
NEW ADVISORY: Cybersecurity threat - Siemens S7 Series PLCs
There is an activethreat to Siemens S7 Series Programmable Logic Controllers (PLCs). Regardless of PLC type, all PLC owners and operators should apply relevant mitigation measures to reduce the risk to their devices and systems.
If your waterworks uses any PLCs, proactively check that your system is:
Properly protected with all applicable security patches and updates
Isolated from the internet wherever possible
Have strong access controls
Employ security tooling to monitor industrial control systems environments for anomalous or malicious activity
Threat actors are actively targeting the following Siemens PLC models:
S7-200 Series (all CPU variants)
S7-300 Series (all CPU variants including 314, 315 & 317 models)
S7-400 Series (all CPU variants)
S7-1200 Series (CPU 1211C, 1212C, 1214C, 1215C & 1217C variants)
S7-1500 Series (all CPU variants, including F-series safety controllers)
Note that threat actors are using AI assistance to generate exploitation scripts using publicly available information on these Siemens S7 series PLCs for initial access, credential access, denial of service and other objectives.
Additional cybersecurity information and resources can be found further down in this newsletter.
Communicate with Local Building Officials Regarding Service Line Replacements
The federal Lead and Copper Rule Improvements (LCRI) advanced by the United States Environmental Protection Agency (US EPA) requires waterworks to replace service lines classified as lead and galvanized requiring replacement (GRR) within defined timeframes. This effort will protect public health, as it will reduce exposure to lead through drinking water.
The portion of the service line owned by the property owner is subject to the Uniform Statewide Building Code and replacement of this portion of the service line is subject to permitting by the local building official.
Waterworks with lead and/or GRR service lines should reach out to and inform the local Building Official of the following:
Plans for future service line replacement work, including the anticipated scope and timing, as well as the contractors that will complete the work, if known.
Waterworks will complete annual notifications to customers with lead, GRR, or unknown material service lines with information on the utility’s service line replacement program and how to reduce their lead exposure.
Customer replacement of a lead or GRR service line will trigger a requirement for the waterworks to complete replacement of the utility-owned portion of the service line within 45 days. The waterworks needs notification of customer replacement, either by the customer or the building official.
More information can be found on EPA’s website and the Office of Drinking Water (ODW) LCRI website.
US EPA : Checklist for Laboratories providing Analytical Support for Water Contamination Incidents
The US EPA has developed a Checklist for Laboratories providing Analytical Support for Water Contamination Incidents which outlines actions utility, commercial, municipal, tribal, state, and federal laboratories can take to prepare for and provide support to water utilities during water contamination incidents. The checklist details steps to ensure laboratories provide timely and effective support throughout preparedness, response, and recovery phases of water sector emergencies.
Who should use it?
Utility, commercial, municipal, tribal, state, and federal laboratories that support water sector emergencies.
In spite of recent rains across the state, drought continues to impact substantial portions of the Commonwealth. The Office of Drinking Water (ODW) has continued deploying a weekly survey to community waterworks, with the ODW field offices continuing to monitor their respective regions and inform the drought conservation status list. The weekly survey has approximately a 55% response rate from waterworks.
508 Community Water Systems have some sort of conservation measure in place:
425 of these are groundwater systems
83 of these are surface water systems
55% of the state’s population served by community water systems are impacted by some form of water conservation measures as follows:
39% of Virginia’s population is under voluntary conservation
Less than 1% is under mandatory restrictions
15% are being reached by public education to influence understanding about drought and impacts
Notify the Office of Drinking Water if water levels or production capacity declines, your utility needs assistance, you have updates to report, or if emergency support may be needed. Use ODW's Contact Us webpage for phone and email information.
Information and Opportunities to Improve Physical and Cyber Security at Waterworks
Protecting Your Waterworks from a Cyber Attack
In light of the recent news and warnings about cyber attacks on drinking water systems, ODW is reminding waterworks owners and personnel about available resources to assess their waterworks’ cybersecurity, to implement cybersecurity controls, and, in the event of a cyber attack, to respond to a cyber incident.
The American Water Works Association offers a free Cybersecurity Risk Management Tool that can be used to perform a cybersecurity self-assessment.
The Virgina Fusion Center’s Water & Wastewater Sector Engagement Guide provides “guidance on recommended actions to improve cybersecurity and reduce risk,” as well as including available resources.
Report suspicious activity and threats of violence, including online threats as appropriate to local law enforcement, FBI - Richmond Field Office, and the VSP Fusion Center. The VSP Fusion Center will take appropriate action and investigate reports of concern with appropriate state and federal partners. The EPA Incident Action Checklist for Cybersecurity also includes resources for preparation and recovery.
The Virginia Fusion Center is a collaborative effort of state and federal agencies to identify and respond to acts of terror, criminal activity, and other crimes and criminal hazards. They have a "Water & Wastewater Sector Engagement Guide" available online that can help with preparation.
Hurricane Season Update
The Commonwealth is well into hurricane season, which runs from June 1 through November 30. Now is the time to prepare and review your emergency plans to ensure your utility is ready for severe weather impacts.
This number is for waterworks with an after-hour emergency or need to reach staff during non-business hours. This 24-hr Call Center will take all pertinent information and contact appropriate staff.
Join VA WARN: A mutual-aid network for utilities. Learn more at www.vawarn.org
Know the 2-Hour Reporting Rule: For critical failures or contaminant releases, review reporting guidance on the ODW Website and call 1-866-531-3068 if needed.
Stay Connected
Know Your VDEM Region: Look it up Here and find your priority contacts for your region.
Keep your Local Emergency Manager in the loop - they have additional means to contact the Emergency Operations Center.
VDH Office of Drinking Water is pleased to present this year's series of in-person and online courses offered through a contract with Virginia Tech. These courses are designed to prepare individuals to take initial or advanced licensing exams as well as learn more about owning and operating a public waterworks.
Groundwater Math for Small Systems
September 29 - October 1, 2026
Roanoke, Virginia
Cost: $150 (includes lodging) or $100 (commuter)
Registration Deadline: September 19, 2026
Planning to sit for the licensing exam and need to brush up on your math? Take a look at this class! In-person instruction with plenty of opportunity for discussion and questions.
This course focuses on the math associated with small systems, ranging in classification from Class 6 to 4. Among the topics addressed in this second groundwater course over a 3 day period are basic math, treatment systems, disinfection, water source, administrative math, hydraulics, and chemical feeders.
Course fee includes all course materials, daily breakfast and lunch, and one networking dinner. Participants will receive 2.1 CEUs (21 contact hours) for successful completion of this course.
This program focuses on hands-on exercises at a full-scale plant in southwest VA.
this course is perfect for any water operator, Class I - 6. The goal is to offer hands-on training to help operators understand the function of treatment systems, operate their systems optimally, and produce safe water.
Course fee includes all course materials, daily breakfast and lunch, and one networking dinner. Participants will receive 1.35 CEUs (13.5 contact hours) for successful completion of this course.
The Office of Drinking Water provides regulatory oversight and technical assistance to public waterworks across the state. Our team is made up of staff with broad experiences and background including biology, engineering, geology, administrative support, water operations, and laboratory experience. Check out our open positions at:
Office of Drinking Water using GovDelivery for Communication
You are receiving this email because your email address is associated with a regulated waterworks in Virginia or you signed up to receive the newsletter. Please add this email to your "Safe Senders" list so they land in your in-box and not your spam-box.
If you need to update your contact information, please reach out to:
