Industry veterans don’t use words like “unprecedented” casually. When veteran water-sector cybersecurity specialist Gus Serino told CNN that “the scale and coordination of the recent cyberattacks targeting Minnesota water suppliers is unprecedented,” that word carries professional weight. CISA formally confirmed a “significant increase” in threat actors targeting industrial control systems — the exact category of device used in this week’s attack. Together, these assessments describe an attack that exceeded what the sector had prepared for.

WHAT MAKES THIS “UNPRECEDENTED”

Prior US water infrastructure attacks have typically been: isolated (one facility at a time), low-sophistication (credential stuffing or remote access tool abuse), and largely unsuccessful at causing operational disruption. The Oldsmar, Florida incident in 2021 — where a hacker briefly raised lye levels — is the most famous example and was caught immediately by an operator watching his screen.

This week’s attack was different on three dimensions: scale (30+ facilities in Minnesota alone, seven states affected), coordination (simultaneous targeting suggesting a centrally directed campaign), and operational impact (actual shutdowns and lockouts, not just probes). The combination of these three factors is what experts are calling unprecedented.

The technical vector — exploiting Unitronics PLCs — is not new. CISA issued specific advisories about this vulnerability in 2023 and 2024 after CyberAv3ngers used the same approach. The unprecedented element is the scale at which it was deployed simultaneously across multiple states.

WHY THIS MATTERS

Water utilities across the US are beginning an emergency assessment of their own Unitronics PLC exposure. This is the right response, but the fact that it’s happening reactively — after an attack — rather than proactively after years of CISA advisories is itself revealing. Small and rural utilities often lack the technical staff and budget to implement cybersecurity upgrades on the timeline that threat evolution demands.

The CISA “significant increase” language is regulatory communication for “we warned you and the attacks happened anyway.” That is not a criticism of utilities — it is a description of the resource gap between the threat and the capacity to address it.

CONFIDENCE: HIGH

Gus Serino quote is on the record to CNN. CISA official advisory language is a published document. Technical comparison to prior attacks is based on established incident records including Oldsmar 2021 and CyberAv3ngers advisories. Expert characterization of “unprecedented” reflects specific technical differences, not political framing.

⚖️  BIAS CHECK — WHO IS SAYING WHAT
Cybersecurity Experts	Technical consensus that this represents a new scale threshold for US water infrastructure attacks
CISA	Official “significant increase” language — bureaucratic framing for what experts are calling unprecedented
Water Utilities Industry	Alarmed; beginning emergency assessments; lobbying for federal cybersecurity funding
Trump Administration	Downplaying scale; attributing to state incompetence rather than systemic vulnerability
Democrats	Using expert language (“unprecedented”) to reinforce DOGE/CISA cuts narrative

SOURCES

▸  Gus Serino (water-sector cybersecurity specialist) — CNN interview, “unprecedented” quote, August 2026

▸  CISA — “significant increase” in ICS targeting, official advisory

▸  CISA 2023–2024 advisories on Unitronics PLC vulnerabilities and CyberAv3ngers TTPs

▸  Oldsmar, Florida 2021 incident — prior water infrastructure attack reference