Coordinated cyberattack disrupts water utilities in multiple US states
A series of cyber intrusions targeting water systems in at least six states has forced utilities to issue boil-water notices and switch to manual operation, prompting federal and state agencies to urge immediate security measures.
Hackers have breached water treatment and distribution systems in several U.S. states, causing some utilities to issue boil-water advisories and shift to manual control while agencies work to secure the infrastructure. The attacks, described by officials as among the most serious on water facilities in years, have affected roughly 30 systems in Minnesota and prompted similar alerts in Wisconsin and other states.
The U.S. Cybersecurity and Infrastructure Security Agency, the FBI and the Environmental Protection Agency have been coordinating response efforts, emphasizing that no contamination has been reported so far. CISA warned that the intrusions target internet-exposed programmable logic controllers that manage pressure, chemical dosing and other critical functions, and urged facilities to isolate vulnerable equipment.
"I suspect that those attackers are going to … continue to look nationally across the infrastructure," said John Israel, Minnesota’s chief information security officer, adding that the hackers will keep probing weakly configured systems.
State officials have not formally identified the perpetrators, though U.S. authorities consider Iran a possible suspect and are cautious about attributing the attacks without conclusive evidence. The New York Times previously reported on a potential Iranian link, and past incidents have shown Iranian groups targeting U.S. water and energy infrastructure.
Cybersecurity specialists highlighted the sector’s reliance on remote access as a vulnerability. Gus Serino, a water-sector security expert, called the coordinated attacks unprecedented and noted that many utilities still lack basic cyber controls. Joshua Corman, co-founder of a volunteer cybersecurity group, warned that the convenience of remote connectivity must be balanced with robust protection measures.
Federal and state agencies continue to advise water utilities to strengthen defenses, isolate exposed control systems and review security configurations to prevent further disruptions.