At least 12 U.S. states have reported cyber intrusions targeting municipal water treatment and distribution systems, prompting federal officials to warn of a growing threat to critical infrastructure. The incidents, disclosed by state utility regulators and the Department of Homeland Security, were discovered between late March and early May and appear to involve unauthorized access to supervisory control and data acquisition (SCADA) networks that manage water flow and chemical dosing.
The attacks did not cause any confirmed loss of service or public health emergency, but several utilities reported abnormal system alerts and temporary shutdowns of non-essential monitoring functions while engineers investigated the breaches. States including Texas, Ohio, Pennsylvania, and Arizona confirmed that the intrusions were detected by routine network monitoring and that no contaminants were released into the water supply.
U.S. cybersecurity officials have suggested that the tactics, malware signatures, and command-and-control infrastructure resemble previous operations attributed to Iran’s Islamic Revolutionary Guard Corps. While the attribution remains tentative, the pattern of targeting water utilities mirrors Iran’s documented attempts to probe U.S. critical infrastructure in 2020 and 2021.
The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive urging all water utilities to apply the latest security patches, enable multi-factor authentication, and conduct immediate network segmentation reviews. The Environmental Protection Agency is also coordinating with state health departments to ensure water quality monitoring remains uncompromised.
Officials say the investigation is ongoing and that additional states may come forward as utilities complete their forensic analyses. The episode underscores the need for a coordinated national strategy to protect water systems from increasingly sophisticated cyber threats.