US Water Systems Face Growing Cyberattack Risks

Federal investigators are examining a wave of cyberattacks that struck water and wastewater utilities in seven states beginning July 27, with evidence pointing to operators linked to Iran. A memo reviewed by authorities connects dozens of incidents in Minnesota alone to Iranian actors, marking the most sustained campaign against American infrastructure since the current conflict with Iran began six months ago. Victims reported flooding and sudden drops in water pressure after intruders gained remote access to internet-connected devices.

The intrusions centered on programmable logic controllers that manage treatment and distribution operations. Attackers altered internet protocol addresses and passwords, blocking utility staff from monitoring or adjusting system functions. The FBI and Environmental Protection Agency issued a joint advisory urging operators to isolate these controllers behind secure gateways and firewalls rather than leaving them exposed online. They also recommended stricter password policies and access controls limited to verified devices.

This pattern fits a longer record of Iranian-linked operations against U.S. targets. Between 2011 and 2013, individuals tied to Iranian government entities conducted distributed denial-of-service attacks on 46 financial institutions, disabling customer access and imposing remediation costs in the tens of millions. The same indictment charged one defendant with penetrating the control system of the Bowman Avenue Dam in Rye, New York, where operators could view water levels and the status of the sluice gate. Similar efforts have struck political figures, private companies, and other critical facilities over the past decade.

Confirmation of Iranian responsibility in the latest cases remains under review, as investigators weigh technical indicators against the possibility that actors sought to mimic Iranian signatures to complicate attribution during active hostilities. Iranian officials have consistently denied involvement in such activity. The incidents underscore how readily available industrial control equipment can be reached when basic network protections are absent.

Utilities affected so far have not disclosed the precise states involved beyond Minnesota, though the scope spans multiple regions. The FBI noted that pressure losses risk allowing untreated groundwater to enter distribution lines, amplifying operational disruptions. Officials continue to collect logs and forensic data while advising facilities to segment networks and remove unnecessary remote access points.

Past episodes demonstrate that Iranian operators often scan for widely known vulnerabilities in public-facing systems rather than deploying sophisticated zero-day exploits. The current round follows the same approach, exploiting equipment that many small and medium utilities leave connected for convenience. Enforcement of stronger segmentation and credential practices rests primarily with facility owners, who face direct consequences when systems are compromised.