Getting Back Into a Controller Can Erase Its Program

Attackers changed passwords and network addresses on computers used to monitor and control water systems. Utilities lost monitoring or control, and reported effects included pressure loss and flooding, according to a July 30, 2026 FBI/EPA warning. For some affected controllers, restoring access poses another problem: the recovery procedure erases the program that runs the equipment.

The agencies’ announcement covered incidents reported since July 27 by utilities in at least seven states. That is the July account, not an updated victim count. Rockwell’s recovery guidance, updated September 18, explains what restoring access requires for particular controller models. It does not tell us which procedure any individual utility used or how long its recovery took.

The program has to come from somewhere

A controller is a small industrial computer assigned to monitor equipment, control it, or both. Losing access can therefore have different consequences: operators may lose their view of a process, the ability to control equipment, or both. The FBI says the effect depended on the controller’s job and the facility’s ability to switch to manual operation.

Rockwell’s guidance addresses controllers whose passwords are unknown. For the models it covers, recovering access involves clearing the stored program and loading a retained project file. The manufacturer warns that an offline copy is needed before the reset. Once the program has been erased, the controller cannot provide the missing copy.

That creates two separate recovery tasks: regain access to the device and restore the instructions it should execute. A successful reset can complete the first task while leaving the second unfinished. The useful question about a backup is therefore whether it contains the program appropriate for the equipment now in service.

An old file may predate a legitimate change. A more recent copy could contain an unauthorized one. Those are possibilities to check, not findings about any particular utility. The FBI recommends reviewing controller project files against known-good logic and checking backups for malicious changes before deployment. A filename and a recent date cannot establish what the program will do.

The usual connection may not work

There is also a physical requirement that routine remote maintenance can leave untested. For the MicroLogix 1100, one of the controller models identified in the July warning, Rockwell specifies a serial connection for the recovery operation. That means having the appropriate cable and a compatible computer connection available. The procedure does not support Ethernet, the usual wired network connection.

This limitation belongs to that model’s documented recovery route; it is not a rule for every industrial controller. Its practical significance is straightforward: being able to reach a device over the network does not establish that the same equipment can recover it after a lockout. The qualified integrator needs to identify the applicable software, connection hardware and local access requirements for the installed model.

These are preparation checks, not instructions to reset a live process. A restoration demonstration belongs in a separately authorized, safe test arrangement. The manufacturer’s notice provides recovery and hardening guidance; it does not identify a newly disclosed software vulnerability.

Keep the process working during recovery

The agencies also recommend practicing manual operation. That serves a different purpose from blocking an intruder: it can provide a way to continue an essential process while normal monitoring or control is unavailable. Whether it is workable depends on the equipment and the people operating it. A written fallback should not be mistaken for a demonstrated capability.

For an organization that depends on a controller, a useful preparation check starts with one function: establish how it could operate safely during a control outage, locate and verify the retained program, and confirm that the appropriate recovery tools and authorized site access are available. This is our recommendation drawn from the documented dependencies, not a reconstruction of a utility’s response or a report of CTS testing.

The check should leave any missing prerequisite plainly identified. The available records may establish that a backup exists while leaving its contents unverified, or identify the correct connection while leaving the necessary hardware unavailable. Those are specific problems that can be resolved before access to the controller is lost.