When the Hackers Speak PLC: What the April CISA Advisory Means for Canadian Plants

By The Bedford Team

On 7 April 2026, CISA and a group of US agencies put out a joint advisory called AA26-097A. It is the clearest plant-floor cybersecurity warning of the year, and it is about a PLC family that runs in many Canadian plants.

What the advisory actually says

The April 7 CISA advisory names an Iran-linked group that has been disrupting internet-facing Rockwell Automation and Allen-Bradley PLCs since at least March 2026. The targets include water and wastewater plants, energy sites, and government services. The group has been tracked under several names including CyberAv3ngers, Storm-0784, and Bauxite.

The method is direct. Attackers used the same Rockwell Studio 5000 Logix Designer software that engineers use every day. They reached PLCs from overseas IP addresses, edited project files, and changed what HMI and SCADA screens showed operators. Some sites reported real operational losses.

How many PLCs are exposed

Censys analysis from April 2026 puts a number on the problem. Censys found 5,219 internet-exposed hosts that respond to EtherNet/IP and identify themselves as Rockwell or Allen-Bradley devices. About 74.6 percent sit in the United States. Canada is part of the remaining group.

Most of the plants on that list did not mean to expose anything. A remote-support port that was supposed to be temporary stayed open. A bridge between control and corporate networks went undocumented. A vendor laptop kept a tunnel alive longer than the contract.

Why this matters for Bedford customers

Bedford supports Allen-Bradley as one of our core PLC platforms. That makes this our wheelhouse, and it means we have an obligation to speak plainly about it.

The first hard truth: if your plant has any Allen-Bradley gear connected to a network that touches the internet, you are in the threat picture. That includes water utilities, food plants, and small process sites that bought one PLC ten years ago and never thought of it again. Defense One’s April reporting on the advisory underlined how broad the target set is.

A practical hardening checklist

The good news in this story is that the fixes are cheap. They take time and discipline, not new hardware.

Start with an inventory. Walk the plant and list every PLC, every HMI, every managed switch, and every remote-support modem or cellular gateway. Note firmware versions and who installed each piece. Then check which of those devices have a path to the public internet, even an indirect one through corporate IT.

Next, cut the paths you do not need. Pull modems and cellular gateways that are no longer in use. Put PLCs behind a firewall, in their own network zone, with traffic in and out kept to a short list. Where remote access is required for support, use a managed VPN with multi-factor sign-in.

Then lock down the engineering software. Studio 5000 Logix Designer should not run on shared laptops with weak passwords. Turn on multi-factor authentication. Track every project download. Keep a log of who changed what and when.

What to do in the next two weeks

This is not a project that needs a six-month plan. The first pass can be done in two weeks at most plants. Run the inventory. Pull the obvious internet-facing gear. Patch what the vendor has flagged. Write down what you found.

If your team is stretched, ask an integrator to walk the network with you. Bedford does this work across New Brunswick, Nova Scotia, PEI, and farther afield. We have done shipboard work in the Bering Strait and on plants overseas, and the basics are the same: see what you have, close what you do not need, log what is left.

The April CISA advisory is the rare kind of bad news where the right fix is also the cheapest one. Plants that act on it this month will be safer, simpler to run, and easier to insure for years to come.

Published April 16, 2026. Bedford Industrial Automation Inc. is a Canadian industrial automation, electrical, panel-shop, and on-site service company headquartered in Dieppe NB.