Cyberattacks on Water Utilities in Multiple States

Recently, cyber incidents targeting water and wastewater infrastructure have put utilities across several states on alert. Federal authorities are investigating attacks that disrupted operations and exposed critical public service vulnerabilities.

Federal Warning and Initial Attacks

On July 30, the FBI and Environmental Protection Agency (EPA) alerted that malicious actors targeted systems in at least seven states starting July 27, 2026. These attacks caused operational disruptions and degraded water services. Since then, incidents in four states matched this warning.

FBI Alert Details

The FBI revealed that attackers targeted internet-facing Programmable Logic Controllers (PLCs), essential devices for monitoring and controlling industrial equipment at water and wastewater facilities. Hackers altered IP addresses and passwords, leading utilities to lose capabilities for monitoring and control. Reported consequences included flooding and pressure loss.

Federal officials stated that water utilities in at least seven states reported incidents. Authorities haven’t yet identified the affected states but urged utilities to enhance cybersecurity by removing exposed systems from the internet.

Newsweek reached out to the FBI for clarification on affected states while engaging the Cybersecurity and Infrastructure Security Agency (CISA) for further attack details.

Minnesota: A Significant Cluster

Minnesota disclosed a large incident cluster. State officials reported cyberattacks targeting over 30 water systems statewide. These attacks captured national attention when President Donald Trump criticized Minnesota’s cybersecurity efforts during a discussion on infrastructure threats, labeling officials as “grossly incompetent.” State authorities continue to investigate the attack origins.

Other State Incidents

Michigan

Michigan reported an incident affecting a water system. Authorities noted incidents in several communities mirroring the tactics described by the FBI and EPA. The Department of Environment, Great Lakes, and Energy said hackers altered equipment settings at a wastewater facility. The situation was successfully contained without threatening drinking water supplies.

South Dakota

Rapid City, South Dakota confirmed a cyber incident targeting a wastewater lift station. City officials assured the attack did not affect drinking water quality or public safety. They isolated impacted systems and are working with law enforcement and cybersecurity experts. Local authorities emphasized Rapid City’s water supply safety.

California

California experienced a recent water infrastructure cyber incident. In June, Government Technology revealed California Water Service (Cal Water) launched an investigation after a hacking group claimed a breach of the company’s systems. Investigators found hackers accessed an active customer’s Cal Water account using stolen credentials but detected no penetration of core networks or operational technologies. The utility affirmed no service disruptions or evidence of access to distribution or treatment controls.

Speculation of Iranian Involvement

Authorities are probing if the cyberattacks could be linked to Iranian hackers. Federal agencies haven’t attributed the incidents formally, and the investigation continues.

CBN reports officials considering Iranian connections, although cautioning that assessments might change as more evidence emerges. Investigators also evaluate possibilities of other actors imitating Iranian tactics to mislead the investigation.

Historical campaigns targeting the U.S. water infrastructure potentially influence current speculations. The Municipal Water Authority of Aliquippa in western Pennsylvania was attacked on November 25, 2023, linked to Iran-associated threats against U.S. infrastructure.

FBI and EPA didn’t specify a country or group responsible when issuing their July 30 alert. The focus remains on attack methods rather than attribution. Utilities nationwide should secure internet-facing control systems as a precaution.

Iranian connection is politically sensitive, with Trump dismissing Iranian responsibility claims related to Minnesota incidents. Investigators have yet to identify the responsible parties.

Potential for More States Involved

The FBI’s warning suggests reports from water systems in at least seven states, raising possibilities of undisclosed impacted regions.

These events underscore concerns over America’s water systems security, serving millions of residents with increasing reliance on remote monitoring and management technologies.

Investigators aim to determine responsible parties and connect incidents in Minnesota, Michigan, South Dakota, and California with the federal warning campaign.