Cyberattacks hit water utilities in twelve US states

Washington – 08/08/2026: A series of cyberattacks on municipal water and wastewater systems has affected at least twelve states, according to US media reports. The targets are primarily digital controls used to monitor pumps, valves, water pressure and treatment processes. The FBI is investigating the incidents but has not publicly identified a perpetrator for the latest wave of attacks.

In Minnesota, malicious activity affecting operational technology was detected at more than 30 facilities last week. In Michigan, the responsible environmental department reported nine affected systems. According to local authorities, the facilities continued to operate safely; there were no known public health consequences. Some operators temporarily switched to manual control. An attack was also recently reported in Georgia.

Authorities are taking indications of Iranian involvement seriously, but no formal attribution has been made for each individual incident. The Environmental Protection Agency, the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the National Security Agency had already warned on April 7 of an acute and ongoing threat from Iran-linked actors. At the time, they reported intrusions into operational technology across several areas of critical infrastructure.

According to authorities, attackers may delete configurations, manipulate digital sensors and disrupt control interfaces used by plant personnel. At water utilities, this could lead to pressure losses and operational interruptions and, in extreme cases, damage to treatment and distribution. In Minnesota, drinking water remained usable, according to state authorities. Moreover, confirmed access does not necessarily mean that supply to an affected municipality will fail or that water quality will be impaired.

The attacks are hitting a highly decentralized sector. The US Government Accountability Office counts nearly 170,000 drinking water and wastewater systems in the country. Many smaller utilities operate with older controls, limited specialist staff and constrained budgets. While remote access makes it easier to maintain extensive networks, inadequate security can also open a path to pumps and other physical components. The large number of independent operators also complicates consistent security standards and rapid situational awareness.

Politically, the consequences extend beyond immediate supply security. Attacks on local infrastructure can create uncertainty even when they cause no lasting damage. The FBI is urging operators to report suspicious activity promptly and to secure internet-connected operational technology consistently. The EPA offers technical support to municipal utilities. In the cases confirmed so far, the responsible authorities found no immediate threat to drinking water quality.