A coordinated series of cyberattacks on American water and wastewater infrastructure, which began in late July 2026 and continued to expand with new confirmations around Monday, August 3, has affected systems in at least seven states.
Federal authorities, including the FBI and Environmental Protection Agency (EPA), have warned of malicious actors remotely accessing internet-exposed industrial control devices, leading to operational disruptions in some cases while officials emphasize that drinking water safety has not been compromised on a broad scale.
The campaign first came to public attention when Minnesota officials reported that more than 30 municipal water systems experienced coordinated malicious cyber activity on July 26 and 27. Attackers focused on programmable logic controllers (PLCs)—small industrial computers that monitor and control equipment such as pumps, valves, wells, and treatment processes.
Many of the targeted devices were internet-facing models, particularly Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series. Hackers altered IP addresses and set or changed passwords, locking operators out of monitoring and control functions.
Impacts varied. In some locations, such as the small city of Braham, Minnesota (population about 1,700), the water plant briefly went offline, prompting requests for residents to limit usage while operators switched to manual controls. Other systems reported loss of pressure, temporary flooding risks, boil-water notices, or sustained manual operations.
Federal and state officials have repeatedly stated that there were no known instances of water contamination or significant public health threats, and most facilities restored normal functions relatively quickly.
By early August, the scope had widened. Michigan confirmed that nine water systems reported activity consistent with the attacks, with all continuing to operate safely and no public health concerns. Georgia also acknowledged limited impacts, and reports linked South Dakota (including an incident involving a wastewater lift station in Rapid City) and additional unnamed states to the same pattern.
An FBI public service announcement issued around July 30 noted that water and wastewater utilities in at least seven states had reported incidents since approximately July 27, with some activity degrading operations.
Attribution and Geopolitical Context
While the FBI has not issued a formal public attribution, multiple U.S. officials, intelligence sources, and cybersecurity experts have pointed to Iran-linked or Iranian-affiliated actors as the likely perpetrators. This assessment aligns with earlier Cybersecurity and Infrastructure Security Agency (CISA) advisories, including updates in July 2026 warning of ongoing Iranian-affiliated targeting of internet-connected operational technology (OT) devices across critical infrastructure sectors, including water systems. The activity lacks a clear financial motive (such as ransomware demands) and fits patterns of disruption and probing associated with state-aligned groups amid the broader U.S.-Iran military conflict that began earlier in 2026.
President Donald Trump publicly rejected the Iran theory in comments last week, instead blaming Minnesota state officials and Governor Tim Walz for “gross incompetence.” Experts and officials note that the attacks hit systems in multiple states, underscoring sector-wide vulnerabilities rather than isolated local failures.
Technical Vulnerabilities and Official Response
The attacks exploited a longstanding weakness: many smaller municipal water utilities operate with limited IT staff and budgets, leaving PLCs directly exposed to the internet rather than behind firewalls, VPNs, or secure gateways. CISA and the FBI have urged operators nationwide to immediately remove publicly exposed PLCs from the internet, enable strong password protections, implement access controls, and shift to segmented networks. CISA described a “significant increase” or “significant escalation” in such targeting.
Utilities across the country have scrambled to audit and harden systems. Cybersecurity specialists emphasize that while the immediate disruptions were contained, the incidents highlight risks to fragmented critical infrastructure. Pressure loss in water systems, for example, could theoretically allow untreated groundwater intrusion if prolonged—though no such contamination was reported here.
As of August 4, investigations continue, with federal agencies assisting states and operators. The episode serves as a stark reminder of the exposure of essential services in an era of heightened cyber conflict, prompting renewed calls for investment in securing the thousands of often under-resourced local water systems that serve American communities.
Officials stress that the public water supply remains safe, but vigilance and rapid isolation of vulnerable devices remain critical.
