Federal authorities are investigating a series of cyberattacks that have disrupted municipal water and wastewater systems in at least seven states. The incidents, which began surfacing late last week, forced several local utilities to switch to manual operations to maintain service. While investigations are ongoing, officials are examining potential links to Iranian-affiliated hackers who have previously targeted U.S. critical infrastructure. Despite the operational disruptions, authorities have emphasized that water supplies remain safe and there are no known public health threats at this time.
The attacks appear to exploit vulnerabilities in internet-connected industrial control systems, specifically programmable logic controllers used to manage water pressure and treatment processes. By gaining remote access to these devices, unauthorized actors were able to alter settings, change passwords, and lock local operators out of their monitoring displays. This forced utilities to rely on manual oversight to ensure the continued safety and distribution of water to residents.
This is not the first time U.S. infrastructure has faced such threats. Federal agencies, including the FBI and the Cybersecurity and Infrastructure Security Agency, have previously issued warnings about nation-state actors targeting energy and water facilities. These agencies continue to urge local operators to remove sensitive equipment from the public internet and implement stronger security measures like multifactor authentication to prevent future unauthorized access.
As the investigation proceeds, federal officials are working closely with state and local partners to identify the source of the activity. While some evidence points toward Iranian actors, investigators caution that attribution is complex and that attackers sometimes use techniques designed to mimic other groups. The focus remains on securing these systems and ensuring that critical public services continue to function without further interference.