Key Takeaways
- Water and wastewater utilities in at least 12 U.S. states have reported cyberattacks affecting operational technology, with incidents first noted in Minnesota and later spreading to Michigan, Georgia, South Dakota, and others.
- Federal agencies (CISA and the FBI) have linked the attacks to Iranian state‑backed hackers who are targeting internet‑connected programmable logic controllers (PLCs) used in water‑treatment and distribution systems.
- The intrusions have caused tangible impacts, including loss of pressure, flooding risks, and precautionary boil‑water notices that were lifted after water‑quality testing confirmed safety.
- CISA and the FBI urge utilities to remove publicly exposed PLCs from the internet, enforce strong authentication, segment networks, and deploy firewalls to mitigate further compromise.
- Experts warn that the attacks threaten military installations, critical data‑center infrastructure, and public trust, echoing the irony of Iran targeting the same PLC technology once disrupted by the Stuxnet worm against its nuclear program.
Overview of the Cyber Campaign
Since late July 2024, a series of cyber intrusions has struck water and wastewater utilities across the United States, with reports emerging from at least twelve states. State officials in Minnesota were the first to disclose incidents, and the FBI later confirmed that utilities in seven states had experienced operational disruptions by July 27. Subsequent reporting by ABC News expanded the tally to twelve states, noting remediation efforts underway in Michigan and other regions. The pattern of attacks—remote access to devices, password changes, and loss of monitoring control—suggests a coordinated campaign rather than isolated incidents.
Geographic Spread and Reported Incidents
Beyond Minnesota, affected utilities have been identified in Michigan, Georgia, South Dakota, and additional states that have not been publicly named. In Georgia, the Clayton County Water Authority announced a temporary disruption affecting part of its operational systems and water service in north Clayton County, prompting a precautionary boil‑water advisory that was later lifted after testing showed no contamination. A neighboring water authority in Georgia also reported a cyber incident the following day. South Dakota’s utilities similarly disclosed an intrusion, while Minnesota and Michigan continue to see multiple facilities undergoing remediation.
Attribution to Iranian State Actors
Although U.S. federal agencies have refrained from making a public attribution, multiple cybersecurity sources and intelligence officials have pointed to Iran as the likely perpetrator. Since 2023, Iranian hackers have repeatedly targeted a specific class of operational technology—programmable logic controllers (PLCs)—used by water and wastewater facilities. The consistency of tactics, techniques, and procedures across the observed intrusions aligns with known Iranian cyber‑espionage patterns, reinforcing the assessment of state‑sponsored involvement.
Case Study: Clayton County Water Authority, Georgia
The Clayton County Water Authority’s statement highlighted that the intrusion caused a temporary disruption to a portion of its operational systems and water service in parts of north Clayton County. In response, the authority issued a precautionary boil‑water advisory to protect public health while it investigated the cyber activity. After conducting water‑quality tests that returned negative for contaminants, the advisory was rescinded. The episode underscored how a cyber breach can quickly translate into a public‑health precaution, even when no actual contamination occurs.
Additional Georgia and Regional Impacts
A second water authority in the Atlanta metropolitan area also reported a cyber incident on the day following Clayton County’s disclosure, indicating that the threat may be spreading within regional networks. While details remain limited, both entities confirmed they are working with state and federal cyber‑defense teams to contain the breach, restore normal operations, and harden their systems against further intrusion.
Incidents in South Dakota, Minnesota, and Michigan
In addition to the Georgia cases, a water utility in South Dakota acknowledged a cyberattack, joining the growing list of affected states. Minnesota, where the campaign first surfaced, continues to see multiple utilities reporting disruptions that impacted operations. Michigan has been highlighted by ABC News as a state with several facilities currently engaged in remediation efforts, suggesting a concentrated focus on the Great Lakes region.
CISA Advisories and Mitigation Guidance
The Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory two weeks prior to the latest wave of reports, warning that Iranian state hackers are targeting internet‑connected PLCs and other operational technology devices. A follow‑up advisory released last week noted that attacks on PLCs have “resulted in boil water notices and sustained manual operations,” affecting utilities of all sizes. CISA Acting Director Nick Andersen urged critical‑infrastructure owners to remove publicly exposed PLCs from the internet immediately, implement network segmentation, and enforce strong, unique passwords for all devices.
FBI Response and Technical Details of the Intrusions
The FBI confirmed it is collaborating with other federal agencies to protect water utilities from the intruders. According to the agency, the attackers follow a consistent pattern: after gaining remote access to a PLC, they change passwords and disable legitimate monitoring and control functions. This manipulation can lead to loss of pressure, overflow, or flooding within the distribution system. The FBI warned that pressure loss could permit untreated groundwater to infiltrate pipes, posing a contamination risk. It reiterated CISA’s recommendations—air‑gapping PLCs where possible, deploying firewalls, and restricting device communication to trusted control nodes—as essential defensive steps.
Systemic Vulnerabilities and Funding Challenges
Water utilities have long been a concern for federal cyber defenders because many operate with limited budgets, making it difficult to invest in robust cybersecurity measures. The potential impact of a successful attack is disproportionate: a compromised water system can affect tens of thousands of residents, disrupt hospitals, and jeopardize industrial processes that rely on clean water. This funding gap leaves smaller utilities especially exposed, as they often lack dedicated IT security staff and rely on legacy equipment that may not support modern security controls.
Expert Analysis: Strategic Implications and Irony
Jake Braun, a former Biden‑administration cyber official who now leads a volunteer‑expert initiative for water utilities, characterized the attacks as a “significant shot across the bow” by Iran. He outlined three strategic effects: first, the ability to cut off water to U.S. military installations that depend on civilian supplies; second, the threat to data centers and other high‑tech infrastructure—particularly those highlighted in Minnesota—that underpin the nation’s AI and economic dominance; third, the erosion of public trust in government’s capacity to deliver basic life‑giving services at a time of deep political division. Braun also noted the ironic twist that Iran is now targeting the same PLC technology that the United States and Israel allegedly used in the Stuxnet operation to sabotage Iran’s nuclear program years earlier.
Outlook and Recommendations for the Water Sector
As the campaign continues to evolve, water utilities must prioritize immediate hardening of their operational technology while advocating for sustained federal and state funding to close long‑term cybersecurity gaps. Implementing CISA’s and the FBI’s guidance—removing PLCs from public internet exposure, enforcing multi‑factor authentication, maintaining offline backups, and conducting regular incident‑response drills—will reduce the likelihood of successful intrusions. Collaboration between utilities, information‑sharing analysis centers (ISACs), and government agencies will be essential to share threat intelligence and develop sector‑wide best practices. Ultimately, protecting the nation’s water infrastructure requires both technical vigilance and the political will to allocate resources commensurate with the potential consequences of a cyber‑enabled water crisis.