Micro-Comm breach exposes 644 GB of water utility vendor data amid FBI probe

When a small Kansas supplier of programmable logic controllers suffers a ransomware-level data leak, the disruption is not just an IT event. It introduces supplier reliability, replacement-parts, and procurement-vetting questions directly into water utility operations. Buyers in critical infrastructure can no longer assume niche vendors are below the attacker threshold.

U.S. authorities are investigating a data breach at Micro-Comm, a small Olathe, Kansas maker of programmable logic controllers used in wastewater processing, in a case that underscores how third-party technology suppliers have become a critical attack surface for infrastructure security. The FBI's Kansas City field office confirmed contact with the company, while CISA referred questions to Micro-Comm. The breach appears distinct from a suspected Iran-linked campaign that hit PLCs in Minnesota and at least six other states beginning in late July, but the coincidence of timing and target class has intensified concern. Barracuda, a relatively new ransomware group that says it is motivated by profit and is not government-sponsored, posted nearly 850,000 files and roughly 644 gigabytes of data on August 6. Micro-Comm's PLCs control machinery within critical infrastructure networks, specifically wastewater processing facilities.

“

The FBI's Kansas City field office confirmed contact with the company, while CISA referred questions to Micro-Comm.

The exposure matters because water systems and the small vendors that support them remain among the least defended parts of U.S. critical infrastructure. PLCs are the physical edge of operational technology: they translate digital commands into mechanical action, from valve control to chemical dosing. A compromise of the vendor that supplies or programs those devices can create a backdoor into a utility's control environment. The July 30 warning from the FBI and CISA explicitly named PLCs from Rockwell Automation, Schneider Electric, and Siemens as targets, and CISA followed on August 19 with a warning that attackers were using artificial intelligence to ease attacks on Siemens equipment. Siemens said its products are safe and that it was working with CISA.

The Micro-Comm breach introduces a more complicated threat picture. Unlike the July wave, which cybersecurity experts link to a long-running Iranian-affiliated campaign, Barracuda claims a profit motive. Yet the same device class and the same water sector are involved. This overlap creates attribution ambiguity for defenders: a financially motivated ransom group can exploit the same vulnerabilities and fear that a state-linked actor wants to pre-position access or demonstrate disruption capability. The breach also shows that small suppliers, often lacking the security budgets of major industrial automation vendors, can be the weakest link in a supply chain that reaches municipal water systems.