Analyst assessment
DysruptionHub assesses with high confidence that the City of Algonac experienced a malicious cyber incident targeting communications used by its water system. The city’s Aug. 18 council packet says the Water Filtration Plant recently experienced a cyberattack against cellular modems used to communicate with remote programmable logic controllers, or PLCs. Officials said the incident was contained without significant operational impacts.
DysruptionHub assesses it is likely (55-80%) that Algonac was another victim of the late-July 2026 PLC attack campaign, with medium confidence. An Aug. 6 email in the council packet described the attack as occurring “a couple of weeks ago,” placing it approximately in late July. The cellular-modem and remote-PLC targeting matches the FBI and Environmental Protection Agency warning about attacks reported beginning July 27. The shared UIS SCADA context also supports the assessment: Alpena News reported that UIS told customers its July 27 incident involved PLCs and supporting communications. No public authority has specifically identified Algonac as a confirmed campaign victim.
Operational significance
The attack reached communications infrastructure associated with remote water-system controls, creating potential risk to monitoring or control even though Algonac reported no significant operational effects. The city’s Water Department says the plant treats and delivers an average of 1.5 million gallons of water daily to Algonac, Clay Township and part of Cottrellville Township. The public record does not establish a water-service outage, loss of pressure, treatment interruption, unsafe water condition or public-health effect.
Current status
Algonac said the incident was contained. The approved Aug. 18 minutes show the City Council unanimously authorized an $8,850 proposal from UIS SCADA Inc., the city’s SCADA system integrator, for four Pepwave 4G cellular modems with firewall functions, IP whitelisting, antennas, programming and startup services. The public record does not establish when installation was completed, so the post-incident hardening project remains distinct from the contained attack.
Disclosure posture
The first located public disclosure is the Aug. 18 council packet. Its supporting email and UIS quote are dated Aug. 6, but the packet does not provide an exact attack date; “a couple of weeks ago” is the most specific timing in the city record.
Confidence and uncertainty
Confidence is high that the cyberattack occurred and that UIS SCADA was retained for post-incident security work because Algonac’s packet and approved minutes directly document both facts. Confidence in campaign membership is medium because the timing, targeted technology, mitigation and shared integrator align closely with other incidents, but the city and federal agencies have not publicly made that connection.
Ransomware, extortion and threat-actor attribution remain unresolved. Searches for the City of Algonac and cityofalgonac.org found no ransomware or extortion listing, but negative search results do not establish absence. The public record does not establish whether data was accessed, altered, copied or exposed.
Analytic gaps
The public record does not establish the exact attack date, which modem or PLC models were attacked, whether the targeted devices were directly internet-exposed, the initial access vector, compromised credentials, source IP addresses, configuration changes, number of affected sites, loss of monitoring or control, law-enforcement involvement or actor identity. It also does not establish whether forensic review found unauthorized data access or whether all approved modem upgrades were installed.
