txcyber.net — infrastructure / water

Texas water & wastewater cybersecurity

Small Texas water systems have already been hit. The fixes that would have stopped it are mostly free. This page is for operators, city managers and emergency managers.

water sector watch free pilotProject Watershed 250 report48 h · TXCC reviewedNov 10, 2026

01 / CASE STUDY

January 2024: four Panhandle towns

A group calling itself the Cyber Army of Russia Reborn went after small-town water systems on the South Plains. Mandiant reported links to Sandworm, a Russian military intelligence unit, and the U.S. Treasury sanctioned its leader and its main hacker.

replay --incident 2024-01 --region panhandle 4 towns
  1. Muleshoe manipulated A water storage tank overflowed for 30 to 45 minutes before the city took the system offline. The city manager said the attackers brute-forced the password of a vendor-run control interface. Drinking water was not affected.
  2. Hale Center stopped 37,000 attempts to log in to the city’s firewall in four days. The city unplugged the system and ran it manually.
  3. Lockney stopped Officials spotted suspicious activity in the SCADA system early and stopped it before it reached the water system.
  4. Abernathy manipulated The same group claimed an overflow here too and posted video of its hands on the control screens.

// what made the difference

  • The towns that held were watching their logs and could unplug and run the plant by hand.
  • The way in was a control screen reachable from the internet and a password that could be guessed.
  • Vendor remote access counts as your attack surface, even if you never log in to it yourself.

KHOU ↗ (opens in a new tab)GovTech ↗ (opens in a new tab)U.S. Treasury ↗ (opens in a new tab)

02 / FREE HELP

Help available now, at no cost

Project Watershed 250

Six-month pilot launched August 31, 2026 by the White House National Cyber Director and the Texas Cyber Command: red teaming, vulnerability assessments, remediation and AI-assisted defense for Texas water and wastewater utilities, at no cost.

www.txcc.texas.gov ↗ (opens in a new tab)[email protected]

03 / THE EIGHT ACTIONS

What CISA, EPA and the FBI ask every water system to do

From their joint fact sheet, Top Cyber Actions for Securing Water Systems. The first three go straight at how the 2024 attacks got in.

checklist --water 8 actions
  1. 01 Reduce exposure to the public internet Get PLCs, HMIs and remote-access tools off the open internet; put remote access behind a VPN with MFA.
  2. 02 Conduct regular cybersecurity assessments Know your gaps. CISA and EPA offer free assessments and scanning.
  3. 03 Change default passwords immediately Unique, strong passwords on every device, including vendor-installed ones. A guessed password is how Muleshoe’s control screen was reached.
  4. 04 Inventory OT and IT assets You can’t defend a controller you don’t know is connected.
  5. 05 Develop and exercise incident response and recovery plans Include how to run the plant manually; test the plan every year.
  6. 06 Back up OT and IT systems Include controller logic and configurations; keep a copy offline (3-2-1).
  7. 07 Reduce exposure to known vulnerabilities Patch or mitigate, starting with CISA’s Known Exploited Vulnerabilities list.
  8. 08 Conduct cybersecurity awareness training Operators and vendors too; Texas public employees already have an annual requirement.

Fact sheet at cisa.gov ↗ (opens in a new tab)

04 / OBLIGATIONS

What the law requires of water systems

sector --water 3 rules

Who to call if your utility is hit · all compliance obligations · Reviewed Nov 10, 2026. Not legal advice.