- Coordinated cyberattacks hit water utilities in at least a dozen states, causing monitoring and control failures.
- The FBI suspects Iranian hackers, though President Trump blames state officials instead.
- No contamination has been confirmed, but one Georgia system issued a boil-water advisory.
- Federal agencies ignored years of warnings, with key cybersecurity rules rescinded after industry pushback.
- Small towns remain vulnerable as weak default credentials persist across 150,000 public water systems.
A coordinated cyberattack campaign has struck water and wastewater utilities in at least a dozen U.S. states, including Minnesota, Michigan, New Jersey, South Dakota and Georgia, federal investigators said this week. The FBI reported that hackers compromised operational technology, leading to a "loss of monitoring and control functionality" at key facilities.
The attacks began in late July, with Minnesota officials confirming that more than 30 community water systems were targeted over a two-day period. Investigators preliminarily suspect Iranian hackers are behind the breaches, though that assessment could change as evidence is gathered. President Donald Trump has publicly rejected the Iran theory, instead blaming state officials for being "grossly incompetent."
Disruptions reported in multiple states, but no confirmed contamination
The FBI said "malicious cyber actors" targeted water and wastewater systems in seven states in late July, with at least five more states reporting similar incidents since then. Affected utilities experienced disruptions requiring manual overrides, and at least one system in Clayton County, Georgia, issued a precautionary boil-water advisory after reduced water pressure was detected.
"It is very unusual for us to experience a system outage without a water main break," said Erin Thomas, a spokeswoman for the Clayton County Water Authority. "We are still investigating what happened, but something happened."
Minnesota officials said no confirmed impact on drinking water quality has been reported so far. Michigan State Police said that following the breach, all systems in the state continued operating safely and that no known impacts posed a public health concern.
Federal officials ignored years of warnings about aging infrastructure
Federal agencies have warned for years about vulnerabilities in the nation's water infrastructure. In 2023, the Environmental Protection Agency proposed stronger cybersecurity guidelines for water utilities, but the order was rescinded after states and industry groups pushed back in court, arguing regulators had overstepped their authority.
The Cybersecurity and Infrastructure Security Agency issued an "urgent warning" in April that Iranian-affiliated hackers were targeting computers in critical infrastructure networks, including water systems, and broadened that alert in late July, telling operators to take remote controllers off the internet entirely.
"We are facing a reckoning of the consequences of ignoring the importance of investing in our nation's cybersecurity for our critical infrastructure," said Tatyana Bolton, executive director of the Operational Technology Cybersecurity Coalition.
Trump and Walz trade blame as war with Iran drags on
Trump, during a cabinet meeting last week, dismissed Iranian involvement and blamed Minnesota's Democratic governor, Tim Walz, calling him "corrupt." Walz fired back on social media, writing that Trump "knows exactly who is responsible for this attack, and knows that other states were hit too," adding that the episode shows "there's no plan to win a war with Iran."
Federal officials caution that the investigation is ongoing and that attribution could change. Cybersecurity experts note that the hackers appear to have exploited weak or default login credentials on internet-exposed equipment, a vulnerability that remains widespread across the country's estimated 150,000 public water systems.
Small towns bear the cost of a broader security gap
The attacks have not yet caused contamination or widespread service failures, but officials warn the threat remains serious. The FBI has urged utilities to take systems offline where they can, tighten up software security, and make sure manual backups actually work before they're needed. A 2022 law requiring water facilities to report significant hacks within 72 hours has still not been fully put into practice, leaving regulators and the public in the dark on the true scope of the problem — a gap that has persisted across administrations even as the warnings piled up.
Sources for this article include:
