Article
What the advisory says
On July 22, CISA, the FBI, NSA and several other federal partners updated a joint advisory first issued in April. The original warning focused on programmable logic controllers, or PLCs, made by Rockwell Automation and Allen-Bradley. The update adds observed targeting of Schneider Electric and Siemens devices and says other manufacturers’ controllers may also be at risk.
The agencies attribute the activity to an Iranian-affiliated group linked to the Islamic Revolutionary Guard Corps. The actors altered PLC project files and manipulated what operators saw on control screens. Several organizations in water, energy and local government experienced disruptions, and in a few cases operational and financial losses. The update also adds guidance on spotting malicious changes to reusable code modules in Rockwell programs.
Why hospitals are exposed
Health care was not among the sectors named as hit, but the devices are common in hospital buildings. As the AHA noted, PLCs run climate control, access control and similar systems. A tampered controller in an air handler serving operating rooms, a pharmacy clean room or an isolation unit is a patient safety problem, not only an IT problem.
These systems often sit outside the security team’s view. Facilities departments or outside contractors may install and maintain them, sometimes with remote access added for convenience and never removed.
Questions to ask this week
- Do we have an inventory? Ask facilities and IT to jointly list every PLC and building automation controller, including make, model and who maintains it.
- Is anything reachable from the internet? A core recommendation is to cut direct internet access to these devices. Verify it with an external scan, not an assumption.
- Who has remote access? Review vendor connections and require secure, monitored access methods.
- Can we detect changes? Confirm that someone would notice altered controller logic or display data, and compare current indicators in the advisory against your logs.
- Does the incident plan cover buildings? Downtime procedures should include manual operation of critical air handling and door controls.
A governance point
Operational technology security often falls between the CIO, the facilities leader and the compliance office. Boards should ask who owns it, how it is reported and whether recent advisories have been acted on.
Archive entry for Jul 24, 2026, added Nov. 11, 2026.