Suspected Iran Hackers Hit Water in 7 States
Suspected Iran Hackers Hit Water in 7 States
The News
Water utilities in at least seven U.S. states have been hit by cyberattacks on the mini-computers that run their pumps and treatment equipment, the FBI, the Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency say — and the U.S. government has not officially blamed anyone.
Foreign Policy reported Thursday that some officials indicated as many as a dozen states could have been affected, and that multiple former officials it spoke to believe the attacks are very likely linked to Iran.
The clearest confirmed damage so far is mundane and local: boil-water notices. In metro Atlanta, the Clayton County Water Authority — which serves 300,000 homes and businesses — is still investigating whether a hacker caused a three-hour overnight outage on July 27, spokeswoman Erin Thomas told Capitol Beat News Service. She could not confirm a hack.
What Officials Confirmed vs. What's Alleged
Confirmed by federal agencies: attacks on internet-facing PLCs at water and wastewater utilities in at least seven states; operational disruptions; in some cases, hackers "modified passwords to lock out operators and disconnected the [controllers]," CISA said in a recent advisory. CISA said the incidents were serious enough in some cases to have "resulted in boil water notices."
Not confirmed: who did it. The U.S. government has yet to officially attribute the latest attacks to any country or group, Foreign Policy reported. Clayton County has not confirmed that its outage was a hack at all.
Timeline
CISA issues an original warning about Iranian-affiliated targeting of internet-connected operational technology, according to Capitol Beat News Service.
A CISA bulletin updates that warning, saying "ongoing Iranian-affiliated cyber targeting of internet-connected operational technology," including programmable logic controllers, had been disrupting "several U.S. critical infrastructure sectors." The agency advised U.S. organizations to "urgently review" their systems for signs of intrusion.
Water utilities in at least seven states begin reporting incidents involving the computers that automate their processes to the federal government, Capitol Beat reported. The same day, a pump station failure in northern Clayton County, Georgia, cut water for three hours after midnight and forced a boil-water advisory for several communities.
The FBI and EPA issue a joint announcement that "malicious cyber actors" had been attacking utilities' programmable logic controllers, or PLCs, sometimes degrading water operations. The attacks reportedly caused flooding and loss of water pressure, which can let untreated groundwater seep into service pipes. The announcement did not identify the hackers.
WSB-TV in Atlanta first reports the potential connection between Iran, the multi-state hacks and Clayton County. The Atlanta Journal-Constitution reports that local officials in Minnesota and Michigan have confirmed their states were affected, while neither Georgia nor federal officials would confirm that Georgia systems were among the targets.
Reactions
"We're still investigating what exactly caused the outage," Thomas, the Clayton County Water Authority spokeswoman, said. "Some of our equipment just lost power, so we can't confirm that somebody hacked into it." She said that kind of failure had never happened before, and that the authority's technology experts were trying to determine whether PLCs were involved.
A spokesman for the FBI in Atlanta told Capitol Beat: "The FBI and our interagency partners are fully engaged to protect critical infrastructure and we remain well-equipped to protect against cyber threats of all varieties."
"I'm incredibly confident that these attacks are Iran," Cynthia Kaiser, who served as deputy assistant director of the FBI's cyber division under former President Joe Biden, told Foreign Policy. "The geopolitical motivation, capability, the recent history of targeting that sector … all of that points to Iran, and there's not a plausible alternative."
Retired Gen. Paul Nakasone, the former National Security Agency director and head of U.S. Cyber Command, told Foreign Policy that of the 16 critical infrastructure sectors, water "is probably the most brittle." Rob Joyce, a former NSA cybersecurity director, said: "The water municipalities generally just don't have the resources."
What's Next
Clayton County's investigation into the July 27 outage is ongoing. The FBI has recommended that operators lock down their PLCs with firewalls, strong passwords and restrictions on who can access them, and CISA has told utilities to review their systems for intrusions.
No public federal attribution has been issued. Watch for whether the FBI or CISA names Iran outright, and for how many states ultimately report incidents — officials have already floated a number higher than the seven confirmed.
More
The reason water is a soft target is arithmetic. The EPA counts more than 148,000 public water systems nationwide, and Foreign Policy reported there are more than 52,000 separate local water providers — many serving only a few hundred people — against just 3,300 electric utilities.
Many of those small systems run the same third-party equipment, so one flaw opens many doors. The FBI and EPA pointed to components made by Rockwell Automation as the source of vulnerability in this round, Foreign Policy reported. In 2023, an Iranian hacking group known as "CyberAv3ngers" infiltrated the Israeli controller maker Unitronics, whose devices are used in U.S. water systems.
A Georgia Tech professor and his researchers identified thousands of PLCs configured in a way that left them exposed to online attackers, WSB-TV reported; the professor said his lab alerted 7,000 institutions.
Earlier near-misses: a hacker reportedly tried to raise chemical levels at a Florida plant in 2021 before being caught, and a 2024 attack caused a water tank in Texas to overflow.
UMass Dartmouth Running Back, 18, Stabbed to Death
Trump Vows 'AI Force,' Czar; Polls Name Change
Sep 20, 2026
Iran Sends Trump Three Conditions to End War
Sep 19, 2026
Faulty AI Intel Nearly Started War With China
Sep 19, 2026
German General Breuer Elected NATO's Top Officer
Sep 19, 2026
Nobel Laureate: War, Sanctions Crushing Iranians
Sep 19, 2026
Dutch Police Disperse Violent Far-Right Hague Protest
Sep 19, 2026
GOP Midterm Odds Fade With 45 Days Left
Sep 19, 2026
Maher Rejects Tarlov's Claim Democrats Are Less Crazy
Sep 19, 2026
Patrick Clancy Breaks Silence After Ex-Wife Killed Kids
Sep 19, 2026
Trump Cuts Park Staff, Diverts Fees to DC
Sep 19, 2026
Holocaust Heirs Sue LA Museums Over Looted Art
Sep 19, 2026
Trump's Fed Chair Hikes Rates, Defying White House
Sep 19, 2026
Miller Drives Push to Deport Illegal Immigrant Children
Sep 19, 2026
US Lifts Sanctions on Eritrea's Military, Ruling Party
Sep 19, 2026
Air Force Admits US Has Space Weapons
Sep 19, 2026
Turkey Revokes License of Iran's Mellat Bank
Sep 19, 2026
Billionaire Ratcliffe Blasts Britain Over Immigration, Taxes
Sep 19, 2026
Navajo Nation Flash Flood Kills Three
Sep 19, 2026
Explosions Over Riyadh Trigger Saudi Air Alerts
Sep 19, 2026
Sep 19, 2026