Cyberattacks Hit Water Systems in Seven States, Iran Link Under Review

Water utilities across seven states face operational disruptions after cyberattacks that began July 27, 2026, leaving residents exposed to potential pressure loss and flooding that could allow untreated groundwater into pipes. The FBI and EPA issued a joint alert detailing how attackers remotely accessed internet-facing programmable logic controllers, changed IP addresses and passwords, and blocked operators from monitoring equipment. Victims in affected utilities reported degraded service, and CISA noted cases that prompted boil-water notices.

The central tension remains whether Iranian-affiliated actors carried out the campaign. A memo circulated to the Water Information Sharing and Analysis Center linked more than 30 Minnesota incidents to tactics described in CISA’s April advisory on Iran-linked groups targeting industrial control systems. Federal investigators continue to examine the connection, and no formal attribution has been issued. President Trump attributed responsibility to Minnesota state officials instead.

Authorities recommend utilities install secure gateways and firewalls, enforce strong passwords, and restrict communications to authorized devices only. Past incidents involving similar PLC devices, such as the 2023 shutdown of pumping equipment in Aliquippa, Pennsylvania, showed that attackers can reach physical operations when default credentials remain in place. No confirmed contamination has occurred in the current wave, though the risk of seepage into distribution lines persists until systems regain control. The FBI has received reports of flooding and pressure drops directly tied to the intrusions.