The utility says its control systems are not directly exposed to the internet and that staff can operate plants manually if needed. Raleigh’s system, serving about 670,000 customers, reviewed its safeguards as federal officials warned of increased attacks on industrial controllers.
Raleigh Water said its programmable logic controllers are not directly exposed to the public internet. The utility serves about 670,000 customers. Assistant Director Ed Buchan said plants could be operated manually during a disruption.
Raleigh Water completed a CISA stress test last year that simulated a cyberattack. CISA urged utilities to remove publicly exposed industrial controllers from the internet. Federal officials were investigating attacks affecting water facilities in several states.
Industrial controllers operate valves, chemical feeds and other treatment functions. Manual operation can preserve service but may be slower and more labor-intensive. A utility’s readiness claim documents its stated controls, not proof that every attack can be prevented.
At the publication cutoff, the checked record establishes the following limit: Raleigh Water disclosed no local breach, and attribution of attacks elsewhere remained under federal investigation. The next public records expected to update this account are new CISA or FBI attribution findings and any local incident notice, boil-water advisory or additional stress test.
This article separates completed events from announcements, allegations, forecasts and proposed actions. Statements by governments, companies, litigants and other interested parties establish what those parties said; they are not treated as independent proof of every underlying assertion. Numerical values describe the source period and category identified in the reporting and may be revised by the responsible institution.
The account is fixed to the August 1 edition cutoff and retains the exact source pages checked for Raleigh Water Details Defenses After Attacks Hit Utilities Elsewhere. A later filing, official release, verified field report or corrected dataset could change a total, timetable or attribution without erasing the documented sequence available at this cutoff. No image is included because no rights-cleared visual was required to report the facts.