Analyst assessment
DysruptionHub assesses with high confidence that a July 27 cyberattack disrupted operational-technology monitoring used by the Charter Township of Alpena, Michigan, for its water and sewer systems. We reported that the township’s contractor lost remote monitoring after UIS SCADA’s CRUiSE platform was hacked and had to reprogram programmable logic controllers at multiple township sites so they could reconnect. Township Supervisor Abbi Kaszubowski publicly described the event as a cyberattack and said a SCADA upgrade was needed to close known vulnerabilities and prevent a recurrence.
DysruptionHub assesses with medium confidence that Alpena Township’s incident is part of the broader late-July 2026 PLC campaign. UIS told customers that the July 27 incident involved PLCs and platform-support communications, while the FBI and EPA warned that utilities in at least seven states reported attacks beginning July 27 against internet-facing Rockwell Automation/Allen-Bradley PLCs, with recurring third-party network configurations enabling activity across customers. The timing, PLC involvement, cellular communications and multi-customer vendor context align, but the federal notice does not identify Alpena Township, UIS SCADA or CRUiSE, and the township record does not identify the PLC manufacturer or model.
Operational significance
The documented impact was loss of remote monitoring across multiple township water and sewer sites. F&V Operations and Resource Management, the township’s contracted system operator, reprogrammed PLCs so the sites could reconnect. The township then considered a $14,495 UIS proposal to replace 15 older cellular modems with hardware supporting firewalls and IP whitelisting. This establishes a material SCADA monitoring and contractor-service disruption even though the township’s system is used mainly for monitoring rather than treatment-plant control.
The incident did not produce a documented water or sewer service outage. Water and sewer service continued safely, and no known public health impact was reported. Alpena Township was described as less seriously affected than customers whose SCADA systems controlled treatment operations. The M-32 booster station has remotely changeable pump setpoints, creating a potential distribution risk, but no reviewed source establishes that an attacker changed those setpoints or affected water pressure, quality or distribution.
Geographic scope
Alpena Township is the only municipal utility publicly identified as affected in the reviewed incident reporting. Ann Arbor, Grand Rapids and Dayton are included at medium confidence as locations associated with the impacted UIS service provider because UIS lists those office markets. They are not documented as three separate municipal utility outages or customer-service disruptions. Michigan officials said nine municipal water systems showed activity consistent with the broader campaign but did not publicly name the other systems.
Current status
DysruptionHub assesses the operational disruption as resolved. Our Aug. 28 report said F&V reprogrammed controllers at multiple sites to restore remote-monitoring connections, while water and sewer service continued safely throughout. The exact restoration time was not disclosed. The investigation, a formal technical all-clear and the proposed modem replacement remained unresolved, but those security and remediation questions do not establish continuing service-delivery or monitoring disruption.
Disclosure posture
The first located public disclosure naming Alpena Township was The Alpena News report on Aug. 28, about one month after the event. That report quoted the township supervisor’s cyberattack characterization and described Aug. 5 written information from the township’s operator and July 27 and July 29 UIS customer communications. This affected-organization evidence supports organization-confirmed cyber and disruption classifications even though the underlying notices were not located as separately published public documents.
Confidence and uncertainty
Confidence is high that malicious or unauthorized cyber activity disrupted remote monitoring because the township supervisor identified a cyberattack and the contractor’s account described a hacked platform, lost monitoring and PLC reprogramming. Confidence is high that township water and sewer service remained available and no public health effect was known. Confidence is medium that the event belongs to the federal late-July PLC campaign because the timing and technical context align but no federal source publicly names Alpena.
The specific access mechanism, ransomware involvement, data impact and actor attribution remain unresolved. Separate searches for Charter Township of Alpena and alpenatownship.com, UIS SCADA and teamuis.com, and F&V Operations and Resource Management and fv-operations.com found no stable ransomware, extortion or leak-site claim as of Aug. 28. The federal alert refers only to malicious cyber actors and does not identify a responsible group.
Analytic gaps
The public record does not establish the initial access vector, exposed service, compromised credentials, vulnerability, source address, PLC manufacturer or model, configuration changes, password changes, ladder-logic changes, persistence, dwell time or whether UIS’s cloud platform itself or customer-connected devices were the initial target. It also does not establish whether operational, customer or administrative data was accessed, copied, altered or removed.
No reviewed source identifies a threat actor, motive, ransom demand, extortion communication or payment. The record does not provide a site-by-site inventory of affected PLCs, the exact duration of monitoring loss, a final restoration time, a final forensic conclusion or authoritative incident-specific confirmation linking Alpena Township to the multi-state campaign.
