The FBI is investigating a previously unreported cyberattack on Micro-Comm, a Kansas company that makes programmable logic controllers (PLCs) used by wastewater facilities. Micro-Comm discovered the breach on July 31, and the Barracuda ransomware group subsequently published what it claimed were nearly 850,000 stolen files totaling roughly 644 GB of data.
What makes this incident different from the recent attacks on individual water utilities is that the hackers compromised a supplier of the technology used to operate water infrastructure. A list of the stolen files reportedly references specific government customers, including local governments and a U.S. military facility, as well as employee information and product diagrams. Roughly 200 Micro-Comm SCADAview CSX systems currently in use across the U.S. are accessible from the internet.
Micro-Comm said passwords, customer credentials and information enabling remote access to its devices were not exposed, and there is no evidence that the breach resulted in the operational compromise of a water system. The FBI also told the company that the attack appeared opportunistic and separate from the recent campaign targeting water utilities in at least seven states.
Donald McFarlane, Advisory Board Member, Xcape, Inc.
“The Micro-Comm incident may well have been an opportunistic ransomware/data-theft attack which is unconnected to the other recent attacks on OT. Nevertheless, that does not make the information stolen from it unimportant.
“An attack on one utility gives you one victim. An attack on a control-system supplier can potentially give you a map to hundreds of victims. Customer identities, engineering information, product diagrams and other technical data can significantly reduce the reconnaissance burden for somebody who wants to attack those systems later.
“Moreover, AI changes the economics of exploiting a large data dump. An adversary can use AI to help sift through the information, correlate customers with products and configurations, analyze engineering documentation, and if source code or other implementation details are available, look for product vulnerabilities worth exploiting. This matters all the more when roughly two hundred Micro-Comm systems are already reachable from the internet.
“You don’t need to steal the remote-access password for stolen engineering information to have intelligence value.
“Micro-Comm isn’t Siemens, Schneider or Rockwell. Despite manufacturing their own line of PLCs, it is a much smaller specialist manufacturer whose scale is closer to that of many regional control-system integrators than to the major global automation vendors.
“And that raises a broader concern: if we’re anticipating targeted adversarial activity rather than simply reacting to opportunistic ransomware, the integrator community deserves particular attention. The system integrators are often small regional engineering companies, but they may hold PLC programs, network diagrams, customer configurations and remote-access pathways for dozens of critical-infrastructure operators. From an adversary’s perspective, that’s an extraordinarily valuable concentration of information.
“The company maintaining the keys and blueprints to a few hundred water systems may have fifty employees. That doesn’t make it a small target.”
Denis Calderone, CTO, Suzu Labs:
“The ICS threat landscape is getting much more sophisticated. In 2023, CyberAv3ngers were simply changing default passwords on Unitronics PLCs and putting political messages on HMI screens. But by July of this year, CISA confirmed that actors were exfiltrating PLC project files using the vendors’ own engineering software and modifying Add-On Instructions to disable safety shutdowns while leaving the operator displays looking normal. Last week, five federal agencies warned that attackers are now using AI to generate working exploitation scripts against Siemens S7 controllers, calling it an evolution that ‘dramatically reduces the technical expertise and time required.’ That’s the trajectory, and the Micro-Comm breach feeds into that narrative.
“What makes the Micro-Comm breach so dangerous is the stolen proprietary data. The five-agency advisory said threat actors are collecting public information about PLC vulnerabilities and using AI to generate scripts that act on it. Now, imagine what becomes possible with a non-public disclosure? There are product diagrams, system architecture documents, customer-specific configurations, details about how SCADAview CSX communicates with the controllers it monitors. You hand that documentation to an unguardrailed AI model and the output is not generic Modbus reads on port 502, it’s targeted tooling built against a specific vendor’s implementation, informed by the manufacturer’s own engineering materials. That’s the difference between FrostyGoop’s 300 lines of Go sending blind register writes and something purpose-built to manipulate the logic in a specific way that an operator won’t notice.
“The FBI says this was opportunistic ransomware, and the attackers probably didn’t know what they had. Barracuda is selling it for $30,000. But there are roughly 200 SCADAview CSX systems sitting on the public internet right now according to Censys, and the buyers of this data may have very different intent than the people who stole it. The joint advisory (AA26-231A) pointed out that the Siemens attack had pre-positioning as one of its goals, so utilities running Micro-Comm equipment should be getting those systems off the internet today, rotating every credential, and asking their integrator to verify that PLC project files match a known-good baseline. If you rely on this vendor’s products, you need to stay diligent. The window between when this data hit the market and when someone with real capability decides to use it is the only time you have to close the gap.”
Critical infrastructure needs to be protected. Or hacks like this will be commonplace. That is as commonplace as every other hack that currently exists. Which is a really sad state of affairs.
Related
This entry was posted on August 26, 2026 at 2:49 pm and is filed under Commentary with tags FBI. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
FBI investigates newly disclosed breach of U.S. water technology supplier
The FBI is investigating a previously unreported cyberattack on Micro-Comm, a Kansas company that makes programmable logic controllers (PLCs) used by wastewater facilities. Micro-Comm discovered the breach on July 31, and the Barracuda ransomware group subsequently published what it claimed were nearly 850,000 stolen files totaling roughly 644 GB of data.
What makes this incident different from the recent attacks on individual water utilities is that the hackers compromised a supplier of the technology used to operate water infrastructure. A list of the stolen files reportedly references specific government customers, including local governments and a U.S. military facility, as well as employee information and product diagrams. Roughly 200 Micro-Comm SCADAview CSX systems currently in use across the U.S. are accessible from the internet.
Micro-Comm said passwords, customer credentials and information enabling remote access to its devices were not exposed, and there is no evidence that the breach resulted in the operational compromise of a water system. The FBI also told the company that the attack appeared opportunistic and separate from the recent campaign targeting water utilities in at least seven states.
Donald McFarlane, Advisory Board Member, Xcape, Inc.
“The Micro-Comm incident may well have been an opportunistic ransomware/data-theft attack which is unconnected to the other recent attacks on OT. Nevertheless, that does not make the information stolen from it unimportant.
“An attack on one utility gives you one victim. An attack on a control-system supplier can potentially give you a map to hundreds of victims. Customer identities, engineering information, product diagrams and other technical data can significantly reduce the reconnaissance burden for somebody who wants to attack those systems later.
“Moreover, AI changes the economics of exploiting a large data dump. An adversary can use AI to help sift through the information, correlate customers with products and configurations, analyze engineering documentation, and if source code or other implementation details are available, look for product vulnerabilities worth exploiting. This matters all the more when roughly two hundred Micro-Comm systems are already reachable from the internet.
“You don’t need to steal the remote-access password for stolen engineering information to have intelligence value.
“Micro-Comm isn’t Siemens, Schneider or Rockwell. Despite manufacturing their own line of PLCs, it is a much smaller specialist manufacturer whose scale is closer to that of many regional control-system integrators than to the major global automation vendors.
“And that raises a broader concern: if we’re anticipating targeted adversarial activity rather than simply reacting to opportunistic ransomware, the integrator community deserves particular attention. The system integrators are often small regional engineering companies, but they may hold PLC programs, network diagrams, customer configurations and remote-access pathways for dozens of critical-infrastructure operators. From an adversary’s perspective, that’s an extraordinarily valuable concentration of information.
“The company maintaining the keys and blueprints to a few hundred water systems may have fifty employees. That doesn’t make it a small target.”
Denis Calderone, CTO, Suzu Labs:
“The ICS threat landscape is getting much more sophisticated. In 2023, CyberAv3ngers were simply changing default passwords on Unitronics PLCs and putting political messages on HMI screens. But by July of this year, CISA confirmed that actors were exfiltrating PLC project files using the vendors’ own engineering software and modifying Add-On Instructions to disable safety shutdowns while leaving the operator displays looking normal. Last week, five federal agencies warned that attackers are now using AI to generate working exploitation scripts against Siemens S7 controllers, calling it an evolution that ‘dramatically reduces the technical expertise and time required.’ That’s the trajectory, and the Micro-Comm breach feeds into that narrative.
“What makes the Micro-Comm breach so dangerous is the stolen proprietary data. The five-agency advisory said threat actors are collecting public information about PLC vulnerabilities and using AI to generate scripts that act on it. Now, imagine what becomes possible with a non-public disclosure? There are product diagrams, system architecture documents, customer-specific configurations, details about how SCADAview CSX communicates with the controllers it monitors. You hand that documentation to an unguardrailed AI model and the output is not generic Modbus reads on port 502, it’s targeted tooling built against a specific vendor’s implementation, informed by the manufacturer’s own engineering materials. That’s the difference between FrostyGoop’s 300 lines of Go sending blind register writes and something purpose-built to manipulate the logic in a specific way that an operator won’t notice.
“The FBI says this was opportunistic ransomware, and the attackers probably didn’t know what they had. Barracuda is selling it for $30,000. But there are roughly 200 SCADAview CSX systems sitting on the public internet right now according to Censys, and the buyers of this data may have very different intent than the people who stole it. The joint advisory (AA26-231A) pointed out that the Siemens attack had pre-positioning as one of its goals, so utilities running Micro-Comm equipment should be getting those systems off the internet today, rotating every credential, and asking their integrator to verify that PLC project files match a known-good baseline. If you rely on this vendor’s products, you need to stay diligent. The window between when this data hit the market and when someone with real capability decides to use it is the only time you have to close the gap.”
Critical infrastructure needs to be protected. Or hacks like this will be commonplace. That is as commonplace as every other hack that currently exists. Which is a really sad state of affairs.
Share this:
Like this:
Related
This entry was posted on August 26, 2026 at 2:49 pm and is filed under Commentary with tags FBI. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.