Cyberattacks Reached Water-System Controls in at Least Seven US States

A series of cyberattacks reached the technology that helps American water utilities run pumps, wells and treatment equipment. Authorities say systems in at least seven states were affected, including more than 30 community water systems in Minnesota and nine in Michigan. The most important qualification is also reassuring: officials reported no known compromise of drinking-water quality or public health.

KEY NUMBER
More than 30 Minnesota water systems were confirmed affected, while federal investigators said malicious activity reached utilities in at least seven states.

Why this is more than another hacked website

Water utilities use operational technology to watch tank levels, start pumps, control wells and manage treatment processes. Many of those tasks are handled by programmable logic controllers, small industrial computers built for reliable physical control rather than modern internet security.

That distinction matters. A stolen customer database is serious, but interference with a controller can stop machinery or deprive operators of remote visibility. The latest incidents did not produce a public-health emergency, yet they show how an online foothold can cross into equipment that communities depend on every day.

What happened at the affected utilities

Minnesota IT Services said coordinated attacks targeted operational technology at more than 30 community water systems on July 26 and 27. The agency activated a statewide response with health, public-safety and federal partners, and said it was not aware of any active request for residents to change how they used drinking water.

The disruptions varied. In Braham, attackers shut down controls connected to a well and treatment plant. Operators isolated the affected system and restored a backup in about 90 minutes, while the town relied on water already stored in its tower. Plymouth temporarily disconnected compromised controllers at two water towers and 14 sewer lift stations, then operated manually until communications were restored.

Michigan disclosed on August 1 that nine systems had also been affected. State officials said local operators resolved the issues and every system continued to operate safely. The Associated Press reported that the FBI is investigating but has not publicly identified a culprit.

How exposed controllers become an entry point

Industrial controllers are sometimes placed online so staff or vendors can monitor equipment remotely. That convenience becomes dangerous when devices use default credentials, weak passwords, undocumented cellular connections or no protective gateway. An attacker may not need sophisticated malware if the control panel itself is reachable from the public internet.

On July 30, the US Cybersecurity and Infrastructure Security Agency warned of a significant rise in attempts against water-sector controllers. It urged operators to remove exposed devices from the internet and to review connections installed by vendors or integrators, including cellular modems that may be missing from normal asset inventories.

A broader joint federal advisory published July 22 described Iranian-affiliated actors targeting internet-exposed controllers to cause disruption. That warning supplies important context, but similarity to a known method is not proof that the same actor carried out every new intrusion.

What happens next

The immediate work is practical: isolate exposed controllers, change default credentials, document remote connections and make sure plants can keep operating manually. Utilities also need tested backups and clear procedures for separating business networks from the systems that control physical equipment.

The larger lesson is not that tap water suddenly became unsafe. It is that small local utilities can sit on the front line of international cyber conflict while lacking the staff and budgets of large energy or technology companies. The limited impact this time reflects quick detection and manual fallback, not proof that the underlying exposure is harmless.

The takeaway

Attackers reached the digital controls behind essential water services across several states, but operators contained the known incidents without a reported public-health crisis. The next test is whether utilities and regulators turn that warning into less internet exposure, stronger access controls and recovery plans before a future intrusion causes more than a brief disruption.