The utility says its industrial controllers are not directly exposed to the public internet and plants can be run manually. The disclosure followed attacks on water facilities elsewhere and a federal alert about internet-accessible control equipment.
Raleigh Water said its programmable logic controllers are not directly exposed to the public internet. The utility serves about 670,000 customers. Officials said treatment plants can be operated manually during a disruption.
Raleigh completed a Cybersecurity and Infrastructure Security Agency stress test in 2025. Federal officials urged utilities to remove publicly exposed industrial controllers from the internet. Raleigh Water did not report a local breach in the account.
Industrial controllers operate pumps, valves and treatment processes. Manual operation can preserve service while requiring more personnel and slower adjustments. A readiness statement documents planned controls but cannot prove resistance to every attack.
The checked record also defines what is not yet established. Federal attribution for attacks elsewhere was not complete, and detailed local network architecture was appropriately not disclosed. This distinction prevents an announcement, allegation, estimate or early field report from being presented as a completed or independently proven event.
At the August 2 publication cutoff, the next evidence expected to update this account is new federal attribution or mitigation guidance and any Raleigh incident notice, exercise or service advisory. Those future developments are not assumed here; they will require a responsible source, a dated public record or independently verifiable reporting.
The source pages retained below support the numerical values, sequence and attributed statements in this report. Statements from interested parties establish what those parties said or did, but they do not independently prove every claim embedded in those statements. No image is included because a rights-cleared visual was not necessary to report the facts.
This edition preserves the difference between the immediate event and its operating context. Industrial controllers operate pumps, valves and treatment processes. Manual operation can preserve service while requiring more personnel and slower adjustments. A readiness statement documents planned controls but cannot prove resistance to every attack. The article will remain fixed at this cutoff even if a later investigation, corrected total, weather observation or implementation record changes the public understanding.