Breaking: Iran-Linked Cyberattacks Hit Water Utilities Across 12 US States — 14 August 2026

Iran-Linked Cyberattacks Hit Water Utilities Across 12 US States

Water and wastewater systems across at least seven, and possibly as many as twelve, US states have been targeted by cyberattacks over the past two weeks, with multiple former US officials and current reporting pointing to Iran as the likely perpetrator. The FBI, EPA, and CISA have all issued advisories confirming the campaign, which targets programmable logic controllers (PLCs) manufactured by Rockwell Automation that manage water flow and chemical composition in treatment facilities.

In multiple incidents, attackers modified operator passwords to lock out legitimate staff and disconnected the PLCs from control systems. CISA confirmed that some attacks were severe enough to trigger boil-water notices to affected populations. While no major disruptions to water safety have been confirmed, operators were able to switch to manual operations in many cases. The gap between "no lasting damage" and "chemical composition tampering" is measured in monitoring capability, not attacker intent.

The targeting pattern follows previous Iranian operations against US water infrastructure. In 2023, the CyberAv3ngers group linked to Iran's IRGC infiltrated Israeli-made Unitronics controllers widely deployed in US water systems. The current campaign shares the same playbook: internet-facing PLCs with weak or default authentication, discovered through automated scanning, then exploited for operational disruption.

Former NSA director Paul Nakasone called water "probably the most brittle" of the 16 critical infrastructure sectors. Former FBI cyber deputy Cynthia Kaiser, now at Halcyon, stated she is "incredibly confident" the attacks are Iranian, citing geopolitical motivation, capability, and targeting history. Former NSA cybersecurity director Rob Joyce highlighted that the water sector's decentralisation, with over 52,000 local providers many serving only a few hundred people, creates an enormous attack surface defended by staff who often lack cybersecurity expertise.

The enforcement gap remains unresolved. The EPA's 2023 attempt to mandate cybersecurity evaluations for water systems was withdrawn after states sued over cost concerns. This week, Democratic Senators Adam Schiff and Amy Klobuchar introduced the Water Shield Cyber Act to give EPA explicit cybersecurity authority, while Republican Representative Rick Crawford's existing legislation proposing an independent cybersecurity standards body for the sector has gained the endorsement of the American Water Works Association, representing 4,300 utilities. New York State has announced over $9 million in cybersecurity grants to protect 153 water systems.

For CISOs: If your organisation operates or depends on water/wastewater infrastructure, audit all internet-facing PLCs immediately, enforce strong authentication on all operational technology, segment OT from IT networks, and ensure manual fallback procedures are tested and current. If you supply technology to this sector, assume your internet-facing management interfaces are being actively scanned and exploited. This campaign is ongoing.