How and Why Are Hackers Targeting U.S. Public Water Systems?
In late July 2026, U.S. water and wastewater systems across at least seven states were hit by a series of coordinated cyber attacks. What happened? Why these systems, and why now? Covering actual things you can do to be prepared.
Cyberattacks Struck US Water and Wastewater Systems (2026)
In late July 2026, a coordinated series of cyberattacks struck U.S. water and wastewater systems across at least seven states. The campaign began with more than 30 municipal utilities in Minnesota on July 26–27 and later included nine systems in Michigan, along with reports from other states.
How the attacks worked
Malicious actors remotely accessed internet-facing programmable logic controllers (PLCs)—primarily Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 models. They changed device passwords and IP addresses, locking operators out of monitoring and control systems. In some cases this produced loss of water pressure, localized flooding, boil-water notices, and a forced shift to sustained manual operations.
Federal agencies including the FBI, EPA, and CISA confirmed the activity. A July 30, 2026 joint FBI-EPA Public Service Announcement (PSA260730) documented the pattern and urged utilities nationwide to disconnect vulnerable control devices from the public internet immediately. No water contamination or public-health impacts have been reported.
U.S. intelligence assessments currently view Iranian-linked actors as the leading suspects, given the timing amid ongoing U.S.-Iran tensions and the similarity to previously documented Iranian-affiliated campaigns against industrial control systems. Official attribution remains under investigation, and alternative perpetrators (including other state actors) have not been ruled out.
Why these targets?
Unlike typical ransomware operations, the attacks showed no demand for payment. The pattern points to intentional disruption of civilian critical infrastructure—creating operational friction, public inconvenience, and a demonstration of reach. Such actions can test response capabilities, generate pressure, and amplify geopolitical messaging without crossing into kinetic conflict.
The broader context includes elevated U.S.-Iran hostilities in 2026 and long-standing warnings about exposed industrial control systems in the water sector. Many smaller utilities still operate with internet-facing PLCs that were never designed for that exposure. An open, highly connected society offers both advantages and attack surfaces; these incidents highlight the latter.
Cyber operations are one tool among many in modern competition—alongside economic, informational, and other measures. They succeed most when they produce fear or paralysis. The practical response is therefore clear:
Do not panic.
Be prepared.
Do not submit to misinformation or exaggerated fear.
Operators should follow the concrete guidance already issued by CISA, the FBI, and the EPA: remove exposed PLCs from the public internet, enforce strong authentication, maintain clean backups, and ensure reliable manual fallback procedures. The public can support better cybersecurity investment and remain informed without amplifying unconfirmed claims. Resilience, not alarm, is the measured answer.
Things you can to do prepare.
- Maintain a stock pile of bottled water and perhaps some emergency water filters and disinfection tablets. This is one reason we work on projects that develop local spring water sources of bottled water. These become great resources during an emergency and most of the operational permits issued by the state require the water to be used for "emergency" purposes. We have gone one step further, we installed a series of rain water collection systems.
- Purchase a Solid Go Bag, emergency radio, and an emergency generator. If you have the budget, you might want to consider a mobile off the grid water treatment system.
- Update the software on your cellphone and home computer and consider installing a VPN (US Based).
- Updated all Passwords on your cameras, security systems, phones, computers, and credit cards and perhaps get a small fireproof safe to store some cash.
- Remove your information from databases. We recommend Incogni. This is a service we use.
- Join or sign up for your state and local community and utility emergency notification services.
Affiliate Disclosure: This article contains affiliate links. If you purchase a product through one of these links, we may earn a small commission at no additional cost to you. We only recommend products we believe in. This helps support our mission to educate consumers about water quality.