What is causing the surge in cyberattacks targeting US water systems?
In July 2026, cybercriminals focused attacks on programmable logic controllers (PLCs) connected to over 100 water and wastewater facilities across the United States. These PLCs are critical industrial computers that manage physical devices such as water pumps and valves, essential for water treatment and distribution. When exposed on the internet without adequate protections, PLCs become prime targets for hackers aiming to disrupt operations.
The attackers have exploited these vulnerabilities by changing passwords and IP addresses on PLCs, locking out legitimate operators and forcing facilities into manual operation. These intrusions have directly contributed to public safety incidents, including the issuance of boil water advisories due to compromised water system controls.
Who is behind these attacks and what are their goals?
Although attribution is complex and often uncertain, reports suggest the activity may be linked to an Iranian state-sponsored group targeting multiple US states. This hypothesis arises from observed attack patterns and geopolitical contexts, but official agencies have not formally confirmed this attribution.
The preliminary nature of these attacks appears to be probing and testing weaknesses in the water infrastructure, potentially setting the stage for more disruptive campaigns in the future. Whether the intent is espionage, disruption, or intimidation, the consequences for public health and safety can be severe if these systems are compromised.
What can water system operators and cybersecurity professionals do now?
The most critical actionable step is to immediately remove any publicly accessible PLCs and other operational technology (OT) devices from direct internet exposure. This significantly reduces the attack surface and limits opportunities for unauthorized access.
Additional measures include strengthening authentication mechanisms, implementing network segmentation to isolate critical control systems, regularly updating and patching devices, and increasing monitoring for unusual activity. Adopting a defense-in-depth cybersecurity posture is crucial for resilience against ongoing and future threats.
How does this affect residents and general users?
For the public, these attacks can result in water service disruptions, manual system operations that may affect water quality, and boil water notices that mandate boiling tap water before use. Staying informed through local utilities and following public health advisories is essential during such incidents.
Users should also be aware that critical infrastructure cybersecurity is a shared responsibility involving operators, regulators, and security experts. Advocacy for better protection measures and support for infrastructure modernization helps reduce community risks.
Practical takeaway: enhancing water system cybersecurity is urgent and ongoing
The surge in attacks on US water systems highlights the urgent need for improved cybersecurity in critical infrastructure. Operators must prioritize removing internet-exposed control devices and adopting comprehensive security strategies to protect public health and service reliability.
While attribution remains uncertain, the real-world impact on water systems and communities is concrete and growing. Proactive cybersecurity measures and coordination between agencies, vendors, and utilities are vital to preventing larger-scale disruptions.
For users, following local advisories and understanding the risks helps mitigate personal impact until infrastructure security improves.