The Cybersecurity and Infrastructure Security Agency, FBI and five other federal partners have updated a joint advisory warning that Iranian-affiliated hackers are now targeting programmable logic controllers (aka PLCs) made by Siemens and Schneider Electric.
The July 22 update adds guidance for detecting malicious changes to reusable code modules in Rockwell Automation PLC programs and flags targeting of Schneider Electric’s Modicon M340 and Siemens’ S7-1200 series controllers, alongside Rockwell’s CompactLogix and Micro850 devices. The agencies said Iranian-affiliated actors have exploited internet-connected PLCs since at least March by altering project files and manipulating data on human-machine interface and supervisory control and data acquisition displays, causing operational disruption and financial loss at some victim organizations.
PLCs are used across healthcare in climate control and access control systems, according to the American Hospital Association, which flagged the update for hospital cybersecurity teams. Hospitals and health systems using affected brands are urged to remove the devices from direct internet exposure and review logs for the newly published indicators of compromise.
A spokesperson for Rockwell Automation, whose PLCs were first named in the April advisory, told Becker’s the “company takes seriously the security of its products and solutions and has been engaged with government agencies in connection with the joint Cybersecurity Advisory.” The company pointed to security advisories it published in 2021 and 2026 with recommendations for hardening operational technology deployments.
The advisory follows a wider pattern of Iranian-linked activity against U.S. healthcare-adjacent targets in 2026, including a March cyberattack on medical device maker Stryker.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.