CISA says over 100 water utilities in 12 states were hit by Iranian-linked cyberattack
The Cybersecurity and Infrastructure Security Agency (CISA) has revised earlier estimates, reporting that more than 100 municipal water and wastewater systems across 12 states were targeted in a coordinated cyber intrusion, likely linked to Iranian state actors.
The Cybersecurity and Infrastructure Security Agency (CISA) announced that malicious activity in July 2026 compromised over 100 internet-exposed systems in the water and wastewater sector, far exceeding the roughly 30 utilities initially reported by federal law-enforcement officials. The intrusions, which began in suburban Minneapolis on July 26, involved unauthorized access to programmable logic controllers (PLCs) that manage valve operation, water flow and chemical treatment.
CISA’s alert noted that the attacks were consistent with tactics previously attributed to Iranian state-sponsored groups. Cyber-security analyst Lesley Carhart, a critical-infrastructure responder with Dragos, said many small utilities lack the resources to detect such incidents, adding that the knowledge of how to exploit these systems is now widely available.
The affected utilities span a dozen states, including Wisconsin, Michigan and Minnesota. Illinois was not listed among the states with confirmed breaches, and state regulations do not require water providers to disclose cyber incidents to law-enforcement or the public.
Authorities continue to investigate the scope of the operation and assess the potential impact on water service safety and reliability.