Cyber Threats Target Water Infrastructure Across U.S. States

Cyber incidents aimed at water and wastewater systems have alarmed utilities in several U.S. states. Federal authorities are probing these attacks, which have disrupted operations and exposed vulnerabilities in public services.

FBI and EPA Warning

On July 30, federal agencies alerted that cyber attackers targeted infrastructure in at least seven states starting from July 27, 2026. The focus was on programmable logic controllers (PLCs), crucial for monitoring and controlling industrial equipment at water facilities. The attacks involved altering IP addresses and passwords, resulting in monitoring and control capability loss. Some systems experienced flooding and pressure loss.

The FBI and EPA did not disclose which states were affected but instructed utilities to secure control systems against internet exposure and enhance cybersecurity measures. Newsweek reached out to federal agencies for more information.

Minnesota’s Significant Impact

Minnesota reported over 30 cyberattacks on its water systems. President Donald Trump criticized state officials’ handling of cybersecurity, highlighting the national concern. Investigators continue to search for those responsible.

Michigan Water System Attack

Michigan officials confirmed an incident matching federal warnings. The attack altered equipment settings at a wastewater facility. Authorities contained it without threats to drinking water supplies.

Incident in South Dakota

Rapid City, South Dakota, faced a cyber incident targeting a wastewater lift station. Officials confirmed no risk to public safety or water quality. The city is investigating with law enforcement and cybersecurity experts.

California’s Cybersecurity Investigation

In California, an incident involving stolen login credentials affected a customer’s account with California Water Service. Investigation revealed no breach of critical operational systems, ensuring uninterrupted water service.

Potential Iranian Involvement

Investigators explore possible links to Iranian hackers, though no formal attribution confirms this. U.S. officials suspect similarities to past Iranian campaigns. For instance, the Municipal Water Authority of Aliquippa in Pennsylvania encountered a notable attack in 2023.

The FBI and EPA did not pinpoint any specific group behind the attacks, focusing on their techniques. The link to Iranian hackers remains speculative and politically sensitive.

Expanding Investigations

With incidents reported in at least seven states, other states might reveal additional cases. The situation underscores the vulnerability of U.S. water systems connected to remote technologies.

Investigation efforts continue to identify perpetrators and determine connections among incidents in Minnesota, Michigan, South Dakota, and California.