Micro-Comm: Barracuda Ransomware and Data Exfiltration at a US Water Sector Supplier

"The FBI is investigating a ransomware intrusion and data theft at Micro-Comm, Inc., a small Olathe, Kansas manufacturer of programmable logic controllers, control panels and SCADA software used by municipal water and…"

The FBI is investigating a ransomware intrusion and data theft at Micro-Comm, Inc., a small Olathe, Kansas manufacturer of programmable logic controllers, control panels and SCADA software used by municipal water and wastewater facilities across the United States. Both the company and the Bureau confirmed the incident to Reuters, which broke the story on August 26, 2026. Micro-Comm says it discovered the attack on July 31. On August 6, a ransomware crew calling itself Barracuda posted what it claimed was the stolen archive: press accounts (Reuters, The Independent, CNA, Post and Courier, TradeVae) consistently describe "nearly 850,000 company files" totalling roughly 644 gigabytes, while the group's own leak-site listing, as indexed by Dark Eye and CyberThreatIntelligence.net, states a precise file count of 894,963 and a size of 643 GB. Micro-Comm has told reporters that no sensitive information was obtained. Investigators say the incident does not appear to be part of the suspected Iran-linked campaign against water plant PLCs that began in July, but it lands squarely in the middle of it.

A sourcing note before anything else: there is no primary-tier disclosure in this record. There is no SEC filing, no state attorney general breach notice, no CISA advisory naming Micro-Comm, and no published vendor security bulletin. Everything below rests on Reuters' original reporting, its syndication, and criminal leak-site data republished by threat-intel aggregators. Leak-site claims are marketing copy written by extortionists and should be treated as unverified until the company or a regulator says otherwise.

What Happened

Micro-Comm detected the intrusion on July 31, 2026, according to statements the company gave Reuters and summarized by TradeVae. TradeVae additionally reports that the company notified customers on August 8; that detail appears in only one downstream aggregation and has not been corroborated by Reuters directly, so treat it as reported rather than confirmed.

On August 6, Barracuda listed Micro-Comm on its dark web leak site alongside a file tree hosted on a public file-transfer service, a size figure, a document-type inventory, and an asking price. The listing status is "selling," with bidding described as "starting at $30,000.00." That price point is notable in itself: thirty thousand dollars is a rounding error against the potential downstream value of engineering documentation for water sector control systems, and it suggests either an operator with limited sophistication about what it stole or a genuine belief that the data is low-value corporate clutter.

Barracuda is new. Reuters, The Independent, CNA and Post and Courier all describe it as a relatively recent, profit-motivated group that publicly disavows government sponsorship. CyberThreatIntelligence.net's profile is internally inconsistent on scale, stating in one place that Barracuda "has listed 4 victims since August 2026" and in another that it has "5 confirmed victims globally." Either way the operation is small and young, which limits how much can be inferred from historical tradecraft.

The timeline data in the aggregator records is also contradictory and should not be relied on. Dark Eye's record simultaneously lists the attack as "Discovered 2026-08-06," "Published August 05, 2026," and "Disclosed / Notified Jul 07, 2026," producing a nonsensical negative 29 day exposure window. CyberThreatIntelligence.net dates disclosure to August 6, 2026, matching press reporting. The August 6 leak-site posting date is the one timestamp corroborated across every source and is the one to anchor on.

What Was Taken

Volume figures differ by source tier and should be stated as a range, not a single number:

File count: "nearly 850,000" per Reuters and its syndications (The Independent, CNA, Post and Courier), versus 894,963 per Barracuda's own leak-site listing as indexed by Dark Eye and CyberThreatIntelligence.net.
Data volume: approximately 644 GB per press reporting, 643 GB per the leak-site listing.
Micro-Comm's position, per Reuters: no sensitive information was obtained.

The gap between the company's characterization and the leak-site inventory is the central unresolved question in this incident. Barracuda's own listing claims the archive contains maps, schematics ("schemes"), personal employee information, personal information on citizens, work photos, emails, and partner personal information. Dark Eye further reports proof-of-breach screenshots posted by the operator with filenames including file_tree.png, finance_2024.xlsx, passport_scan.jpg, and contract_signed.pdf. If accurate, that inventory is not consistent with "no sensitive information," and it spans three distinct exposure classes at once: personally identifiable information on staff and possibly utility customers, commercial documentation on partners and contracts, and engineering material describing deployed control systems.

Brinztech, an OTHER-tier alerting outlet, reports that Micro-Comm's product line includes SCADAview CSX systems, and that internet-monitoring telemetry indicates roughly 200 of the company's control units remain directly reachable from public IP space. Neither the SCADAview product detail nor the 200-device figure appears in Reuters or any other source in this set. Both are single-source claims and should be validated independently before any defender treats the device count as an operational number.

Why It Matters

The strategic weight here is not the ransom, the company's size, or even the volume of stolen files. It is what schematics and site documentation from an OT vendor enable downstream.

Micro-Comm sells into municipal water and wastewater utilities: the exact class of operator that is chronically under-resourced, rarely staffed with dedicated security personnel, and heavily dependent on vendors for integration, configuration and remote support. A single supplier's document repository can therefore function as a reconnaissance package covering dozens or hundreds of separate downstream facilities. Network diagrams, panel schematics, default configurations, integrator contact lists and support credentials do not expire when the ransom negotiation ends. They retain value for years, and once listed for sale at $30,000 they are within reach of buyers whose motives have nothing to do with profit.

That matters because of the context this breach sits inside. Reuters, The Independent, CNA and Post and Courier all place the Micro-Comm intrusion against a backdrop of late July attacks on PLCs at water plants in Minnesota and at least six other states, which cybersecurity experts assess as part of a long-running Iranian-affiliated campaign. On July 30, the FBI and CISA warned that threat actors were actively targeting PLCs from Rockwell Automation, Schneider Electric and Siemens. On August 19, CISA said attackers were using AI to streamline attacks against Siemens equipment; Siemens subsequently said it was coordinating with CISA and that its products are safe.

Reporting is clear that Micro-Comm is apparently not part of that campaign. Dixon Land, a spokesperson for the FBI's Kansas City field office, confirmed by email that the Bureau is in contact with Micro-Comm and coordinating on the response. The honest framing is that a financially motivated crew appears to have opportunistically compromised a water sector vendor during a period when a state-aligned actor was actively hunting for exactly that kind of access, and then put the proceeds up for sale. Whether those two threads ever connect is not something the current public record can answer.

The Attack Technique

Initial access is not disclosed in any source in this set. No CVE, no phishing lure, no compromised remote access mechanism, no credential source has been publicly attributed. Neither the FBI nor Micro-Comm has described how the intruders got in, and neither has released indicators of compromise.

What can be characterized is the extortion model. CyberThreatIntelligence.net describes Barracuda as a double-extortion operation: exfiltrate first, then encrypt. The observable behavior in this case fits the exfiltration-and-publish half of that pattern, with a public leak-site listing, a proof-of-breach screenshot gallery, an externally hosted file tree, and a fixed asking price under a "selling" status. Nothing in the public record establishes whether encryption was successfully deployed against Micro-Comm's environment or what operational disruption, if any, the company experienced.

The roughly six day gap between Micro-Comm's July 31 discovery and Barracuda's August 6 publication is consistent with a failed or refused negotiation, though no source confirms that a ransom demand was made or rejected.

Defenders should note what this means practically: there is no vendor patch to apply and no IOC list to load. The actionable response is not detection engineering against Barracuda specifically. It is assuming the documentation is out and reducing what that documentation can be used for.

What Organizations Should Do

Water and wastewater utilities running Micro-Comm equipment, and any operator dependent on a small OT vendor, should treat the following as immediate work:

Contact Micro-Comm directly and ask scoped questions. Do not accept a general reassurance. Ask specifically whether your site's network diagrams, panel schematics, configuration backups, support credentials, or VPN and remote access details were held in the compromised environment. TradeVae reports customer notifications went out around August 8; if you did not receive one and you are a customer, that is itself a question worth asking.
Rotate every credential the vendor held or could have held. Remote support accounts, shared maintenance passwords, VPN credentials, HMI and SCADA logins, and any API or telemetry keys issued to the vendor. Assume shared or default credentials documented in vendor files are burned.
Audit internet exposure of control equipment now. Brinztech's claim of roughly 200 publicly reachable Micro-Comm units is uncorroborated, but the underlying exposure pattern in the water sector is thoroughly documented. Enumerate your own PLCs, HMIs and SCADA front ends against public IP space, get them behind a VPN or off the internet entirely, and verify by external scan rather than by asset inventory.
Apply the July 30 FBI and CISA PLC guidance across all vendors, not just Micro-Comm. That advisory covers Rockwell Automation, Schneider Electric and Siemens devices. The Micro-Comm breach and the Iran-linked PLC campaign are separate events converging on the same weak surface, and the mitigations overlap.
Assume architectural documentation is public and design around it. If schematics and network maps are in the leaked archive, security through obscurity is gone for every affected site. Prioritize segmentation between IT and OT, enforce inbound access control at the OT boundary, and instrument logging and alerting on engineering workstations and controller reprogramming activity, since a well-informed attacker will look like a legitimate integrator.
Write vendor breach obligations into procurement. Small OT suppliers frequently have no dedicated security function and no contractual disclosure timeline. Require notification windows, incident scope reporting, and the right to audit how your site documentation is stored, and monitor leak sites for your vendors as a standing intelligence task rather than waiting for a press exclusive.

Sources: FBI Investigates Ransomware Attack and Data Exfiltration at Water S... | Hack of water sector supplier draws FBI scrutiny as Iran ... | FBI probe into water system cyberattacks expands after tech supplie... | Exclusive-Hack of water sector supplier draws FBI scrutiny as Iran-... | Micro-Comm Inc. — BARRACUDA Ransomware Attack Dark Eye | FBI probes water supply hackers as Iran-cyber concerns grow | FBI Probes Data Breach at Water-Systems Supplier as Wider Cyber Con... | Micro-Comm Inc. Ransomware Attack by Barracuda (2026) Cyber Threat...