Iran-Linked Hackers Hit US Water Systems, FBI Says

A wave of cyberattacks has disrupted monitoring and control systems at water and wastewater utilities across parts of the United States, prompting warnings from federal agencies and renewed concern about threats to critical infrastructure. The FBI has reported that authorities suspect Iran-linked hackers were behind the activity, although they have not yet confirmed the source of the disruptions.

FBI Reports Loss Of Monitoring And Control

The FBI said on Thursday that “malicious cyber actors” targeted water and wastewater utility companies in at least seven states over the previous four days. Officials said the attacks led to a “loss of monitoring and control functionality”, according to the Bureau.

Attacks have been reported by state officials in Michigan, Minnesota and New Jersey, adding to growing worries about the security posture of public utilities.

Iran-Affiliated Activity Suspected But Not Confirmed

Federal officials suspect that hackers connected to Iran carried out the intrusions, The New York Times reported. However, US authorities have not definitively determined who was responsible for the outages affecting monitoring and control.

The Cybersecurity and Infrastructure Security Agency (CISA), the FBI and other agencies also issued a warning on July 22 about “ongoing Iranian-affiliated” cyber activity targeting water facilities, days before the latest incidents.

The assessment comes amid broader debate about how prepared utilities are for state-sponsored cyber operations. Roughly 150,000 public water systems operate in the country, according to the Environmental Protection Agency.

Limited Security At Treatment Sites

Experts interviewed by The Hill said many water treatment facilities have comparatively modest security measures, making them susceptible to intrusion. They said the attackers’ approach appeared consistent with patterns linked to Tehran, though they could not confirm Iran’s involvement.

Lennart Maschmeyer, an assistant professor at Georgia Tech who studies how emerging technologies affect international security, said the activity appeared aimed at “low-hanging fruit” systems or organisations that lack basic protections. He noted that programmable controllers used in facilities targeted in the attacks can be both specialised and old, and that the systems may be exposed if they are connected to Wi-Fi.

“These are not equipped for dealing with … state-sponsored cyberattacks,” Maschmeyer said, arguing that local water utilities cannot realistically be expected to prepare for all forms of hostile activity at the scale seen in national campaigns.

Alex Jones, chair of the Electrical Engineering and Computer Science department at Syracuse University, said the specific systems used at different infrastructure sites vary substantially, which reduces the risk of a single, widespread cyberattack. He said attackers may have found commonalities among some targeted systems, but that differences between sites provide some protection.

Jeff Greene, a principal at Civira Partners who previously worked at CISA during the Biden administration, said staffing constraints can also limit a facility’s security capabilities. He added that many systems were not designed with cybersecurity as a priority, while still being relatively resilient. Greene said that if necessary, operators can switch to manual operation, including disconnecting components, to keep services running.

Wider Cyber Threat And Retaliation Concerns

Cyberattacks against infrastructure are increasingly viewed as a growing risk, though experts say there have been few clearly demonstrated cases of sustained effectiveness during major wars.

Maschmeyer pointed to 2015, when a Russian group carried out cyberattacks on the Ukrainian power grid during Russia’s initial offensive in eastern Ukraine. The attacks led to power cuts lasting roughly six hours, he said, noting that high-profile cyber incidents have been less evident since Russia began its full-scale invasion more than four years ago.

The article also referenced earlier operations involving cyber tools. Under the Trump administration, US forces used cyber capabilities to turn off power in Caracas, Venezuela, during a January raid intended to capture former President Nicolás Maduro. US forces have also carried out aerial strikes against Iranian infrastructure during the war that passed the six-month mark last week.

Caitlin Durkovich, a former White House National Security Council official, said the Trump administration has “normalizing” cyber and other attacks on infrastructure, which she said could make retaliation more likely. She argued that earlier behaviour was often treated as “off limits”, but that infrastructure is increasingly being placed on the front lines during geopolitical tension.

Join the discussion?

6 August 2026