CISA warns hackers are increasingly targeting U.S. water systems

The Cybersecurity and Infrastructure Security Agency warned that hackers are increasing pressure on U.S. water and wastewater systems and urged operators to remove internet exposure from those networks as soon as possible. The alert focused on programmable logic controllers, or PLCs, the industrial devices that help automate treatment and distribution operations.

The warning landed after Minnesota IT Services disclosed a coordinated cyberattack at more than 30 community water systems on July 26 and July 27. Follow-on reporting said the intruders in some cases changed passwords and disrupted water monitoring and control equipment, a reminder that even brief intrusions can ripple beyond computer screens into billing, treatment operations and public confidence in drinking water reliability. Investigators were also examining a possible Iran connection in the Minnesota case.

Smaller utilities are especially exposed because many run on limited budgets, older equipment and small technical staffs. That leaves them reliant on aging operational-technology systems, third-party vendors and remote-access tools that were often installed for convenience long before today’s threat environment. The Senate Environment and Public Works Committee has described the water sector as highly cyber-vulnerable because of under-resourcing, legacy OT systems and persistent exposure of remote-access pathways.

The federal response has been building for years. In March 2024, the U.S. government warned state governors that foreign hackers were carrying out disruptive attacks on water systems. The Environmental Protection Agency also maintains an enforcement alert and cybersecurity resources for drinking water systems, underscoring that the risk is not limited to one incident or one state. Water is designated critical infrastructure, and disruptions can quickly move from technical trouble to public-safety concern.

CISA’s latest message to operators was practical: secure OT, protect PLCs, and remove devices from the internet where possible. For utilities with thin margins and outdated systems, the gap between the threat and the defenses still available remains wide, and attackers appear to know it.