Cyberattacks on Water Infrastructure Highlight Vulnerabilities

Recent cyber incidents have targeted water and wastewater infrastructure, causing alert across states as federal authorities investigate disruptions. The FBI and Environmental Protection Agency (EPA) warned of malicious actors compromising systems since July 27, 2026, affecting at least seven states. These attacks have disrupted operations, bringing attention to vulnerabilities in essential public services.

Details from the FBI

The FBI reported that attackers targeted internet-facing Programmable Logic Controllers (PLCs) at water facilities. Hackers altered IP addresses and passwords, leading to control and monitoring losses. Affected systems experienced flooding and pressure loss. Agencies have urged utilities to remove exposed systems from public internet access and strengthen cybersecurity.

Incidents in Minnesota

Minnesota saw a significant number of attacks, with over 30 water systems targeted. President Donald Trump highlighted these incidents while addressing cybersecurity threats, criticizing local officials for incompetence. The responsible parties remain unidentified, as investigations continue.

Cyberattack in Michigan

Michigan reported a related cyber incident. Hackers altered settings on wastewater facility equipment, but rapid containment ensured no threat to drinking water. The Department of Environment, Great Lakes, and Energy confirmed the executed security measures.

South Dakota’s Concerns

Rapid City, South Dakota, experienced a cyberattack on a wastewater lift station. While there was no impact on drinking water or public safety, the city isolated affected systems. Authorities are working with experts to investigate further and maintain safety.

California Investigations

California Water Service launched an investigation following a hacker group’s claim of system breach. They found no disruptions to service or operational technology. Investigators confirmed only a single customer’s account was accessed using stolen credentials, with no intrusion into critical systems.

Possible Iranian Connection

Investigators are exploring links to Iranian hackers, although no formal attribution has been made. Past incidents include a 2023 attack on Pennsylvania’s water authority. Federal agencies focus on the tactics used, urging national security measures for internet-facing control systems.

Further Investigation Ongoing

The FBI’s warning suggests more states might be affected beyond the disclosed incidents. These cyberattacks underscore the importance of securing America’s water systems, critical to millions of citizens. The investigation seeks to identify attackers and determine if the incidents in Minnesota, Michigan, South Dakota, and California are interconnected.