Cybersecurity Policy Report, As Drinking Water Systems Get Hacked, Alarms Sound at CISA, FBI, EPA, (Jul 31, 2026)
Federal officials are warning public drinking water utilities to protect their operational technology from hackers that have hit utilities in seven states in recent days.
While officials haven’t publicly named the groups or individuals behind the cyber attacks, the Iranian government is a chief suspect.
“Since 27 July 2026, Water and Wastewater Sector (WWS) utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations,” the Federal Bureau of Investigation and the Environmental Protection Agency said yesterday in a public service announcement.
“Operational effects reported to the FBI have included loss of pressure and flooding. Pressure loss in water systems could potentially allow untreated ground water to seep into pipes,” it said.
The Cybersecurity and Infrastructure Security Agency said it was “currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector.”
“Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses. This activity has resulted in boil water notices and sustained manual operations,” CISA said yesterday in an advisory.
CISA and the FBI advised water utilities to disconnect their PLCs from the Internet, change default passwords on operational technology components, and plan for manual operations. “The capability for organizations to revert to manual controls to quickly restore operations is vital in the immediate aftermath of an incident,” the FBI said.
The attacks first surfaced in Minnesota, where 30 community water systems were affected. “Since learning of this activity, we have assessed its impact, identified methods of access and worked with local partners to better protect Minnesota systems,” John Israel, Minnesota’s chief information security officer, said in a news release.
“We have provided relevant information to the federal government, which is evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor,” Mr. Israel said.
“Investigators have identified similarities among the incidents, including their timing and the types of technology involved. However, the investigation has not determined that every incident was carried out by the same actor,” he added.
The Minnesota state government “is not attributing this activity to a specific actor at this time. Attribution requires investigators to analyze technical evidence alongside broader national and international threat intelligence,” Mr. Israel cautioned.
The Water Information Sharing and Analysis Center (Water ISAC) noted in a notification to its members that Wired magazine had obtained a “leaked memo” that attributed the water system cyber attacks to Iran.
“The ‘memo’ in question is related to the Minnesota water cyber activity and was shared on Monday to WaterISAC members only as TLP:AMBER,” it said, referring to the traffic light protocol (TLP) for disseminating sensitive information. TLP:AMBER indicates information that should not be shared with the public.
“We want to be clear that WaterISAC did not leak this report,” it said. “Additionally, we are asking WIRED to clarify/correct their article to state that they did not obtain the report from WaterISAC.”
MainStory: TopStory FederalLegislation StateLegislation DataSecurity