Federal Officials Warn of Cyber Threat to Water Systems

Key Takeaways

• The Washington State Department of Ecology issued a warning after receiving a National Security Agency (NSA) alert about cyberattacks targeting water and wastewater utilities nationwide.
• Officials in Bellingham confirm they are taking the threat seriously, maintaining existing cybersecurity protections and readiness to respond.
• Cybersecurity Dive reports that public utilities in at least 12 states have been hit, with a coordinated attack in Minnesota affecting more than 30 community water systems in late July.
• Multiple federal agencies—including CISA, the FBI, the Department of Energy, and the Environmental Protection Agency—have echoed the NSA’s concerns and urged operators to isolate systems from the internet and report suspicious activity.
• Recommended mitigations include reviewing the NSA advisory’s tactics, techniques, and procedures; applying hardening measures; disconnecting non‑essential online connections; and establishing clear reporting channels for anomalous behavior.
• The alerts underscore a growing trend of critical‑infrastructure targeting, highlighting the need for continuous vigilance, regular risk assessments, and cross‑agency coordination to safeguard essential public‑health services.

Overview of the Alert from Ecology and the NSA
On Friday, the Washington State Department of Ecology circulated a statement to all municipalities and agencies that provide drinking water or treat sewage, advising them of a newly issued cybersecurity warning. The notice originated from an alert released by the National Security Agency, which identified a series of nationwide cyber incidents aimed at the operational technology (OT) that underpins water and wastewater systems. Ecology urged recipients to read the associated Public Service Announcement carefully, emphasizing that failure to address the identified vulnerabilities could disrupt service delivery and pose risks to public health. The department’s tone was precautionary rather than alarmist, framing the communication as a proactive step to help utilities bolster their defenses before any potential impact materializes.

Details of the NSA Advisory and Its Origins
The NSA’s advisory, which prompted Ecology’s outreach, outlines specific tactics, techniques, and procedures (TTPs) observed in recent intrusions. According to the document, threat actors have been exploiting known software and hardware vulnerabilities in devices commonly used by water utilities, such as programmable logic controllers (PLCs), remote terminal units (RTUs), and supervisory control and data acquisition (SCADA) systems. The advisory highlights that many of these weaknesses stem from outdated firmware, insufficient network segmentation, and the persistence of default credentials. By publishing the TTPs, the NSA aims to give utility operators a concrete checklist for detecting anomalous behavior, patching susceptible components, and implementing segmentation strategies that limit lateral movement within OT environments.

Bellingham’s Response and Preparedness Measures
Deputy Director of Public Works Michael Olinger of the City of Bellingham told The Bellingham Herald that the municipality is already attuned to cybersecurity risks. Olinger noted that water and wastewater services are deemed essential, prompting the city to maintain layered defenses, conduct regular threat assessments, and keep incident‑response plans current. He emphasized that the steps recommended in the Ecology notice align with Bellingham’s existing practices, including routine monitoring of network traffic, periodic penetration testing, and staff training on phishing and social‑engineering tactics. Olinger’s remarks reflect a broader trend among forward‑looking utilities that treat cyber hygiene as an ongoing operational imperative rather than a one‑time compliance exercise.

Nationwide Scope of the Threat According to Cybersecurity Dive
The digital‑industry publication Cybersecurity Dive expanded on the NSA’s warning by reporting that public utilities in at least twelve states have experienced cyber intrusions. The outlet cited Minnesota, Michigan, Georgia, South Dakota, and New Jersey as examples where attackers have attempted to manipulate or disrupt water‑treatment processes. While the article did not disclose the full list of affected jurisdictions, it stressed that the incidents are not isolated flukes but part of a coordinated campaign probing the resilience of critical‑infrastructure sectors across the country. This broader pattern suggests that threat actors are systematically scanning for weaknesses in the nation’s water supply chain, potentially seeking to cause public‑health disturbances or to test the efficacy of their tools for future, more damaging operations.

The Minnesota Incident: A Case Study in Coordinated Attack
Cybersecurity Dive pinpointed the earliest public discovery of the threat to Minnesota, where more than thirty community water systems were targeted in a synchronized push between July 26 and July 27, 2026. The attackers reportedly leveraged a known vulnerability in a widely deployed SCADA software package, gaining unauthorized access to control interfaces that regulate chemical dosing and pump operations. Although utilities managed to isolate the compromised segments before any alteration of water quality occurred, the episode highlighted how quickly a coordinated strike can propagate across geographically dispersed entities that share common software vendors. Post‑incident analyses revealed that many of the affected systems had delayed patching cycles, underscoring the importance of timely vulnerability management in preventing escalation.

Involvement of Other Federal Agencies and Their Guidance
Beyond the NSA, a chorus of federal bodies has issued statements reinforcing the urgency of the situation. The Cybersecurity and Infrastructure Security Agency (CISA) urged owners and operators to review the NSA advisory’s TTPs and to apply recommended mitigations without delay. The Federal Bureau of Investigation (FBI) echoed the call to disconnect non‑essential OT components from the public internet, noting that many intrusions began with exposed remote‑access ports. The Department of Energy (DOE) highlighted the interdependence of water systems with energy infrastructure, warning that a successful cyber‑physical attack could cascade into power‑generation disruptions. Finally, the Environmental Protection Agency (EPA) advised utilities to conduct thorough risk assessments, document any anomalous activity, and report findings to both federal and state authorities to facilitate a coordinated threat‑intelligence picture.

Recommended Mitigation Actions and Hardening Steps
The collective guidance from Ecology, the NSA, CISA, the FBI, DOE, and the EPA converges on a set of practical measures designed to reduce the likelihood of a successful attack. Key recommendations include:

1. Network Segmentation – Separate OT networks from corporate IT and the internet, employing firewalls and unidirectional gateways where feasible.
2. Patch Management – Prioritize immediate application of security patches for SCADA, PLC, and RTU firmware, especially for known vulnerabilities disclosed in the NSA advisory.
3. Credential Hygiene – Replace default usernames and passwords, enforce multi‑factor authentication for remote access, and regularly rotate service accounts.
4. Monitoring and Logging – Deploy intrusion‑detection systems tailored to OT protocols, retain logs for at least 90 days, and establish baseline behavior alerts for deviations in flow rates, pressure readings, or valve positions.
5. Incident‑Response Planning – Update response playbooks to include cyber‑specific scenarios, conduct tabletop exercises quarterly, and designate clear reporting channels to CISA, the FBI, and state environmental agencies.
6. Employee Awareness – Conduct regular training on phishing, social‑engineering, and safe USB‑device usage, recognizing that human error remains a common entry point for threat actors.

By implementing these steps, utilities can significantly lower their attack surface while maintaining the reliability and safety of essential water services.

Broader Implications and the Path Forward
The recent wave of alerts serves as a stark reminder that critical‑infrastructure sectors traditionally viewed as “low‑tech” are increasingly attractive targets for sophisticated adversaries. Water and wastewater systems, while vital to public health, often operate with legacy equipment and limited cybersecurity budgets, creating a tempting attack surface. The coordinated nature of the Minnesota incident demonstrates that threat actors are capable of scaling their efforts across multiple jurisdictions, leveraging common software supply chains to amplify impact. Consequently, the response must be equally coordinated: utilities should engage in information‑sharing forums such as the Water Information Sharing and Analysis Center (Water‑ISAC), participate in regional cyber‑exercises, and advocate for federal funding aimed at modernizing OT infrastructure with security‑by‑design principles.

Ultimately, safeguarding the nation’s water supply is a shared responsibility that spans utility operators, state environmental agencies, federal cybersecurity bodies, and technology vendors. By heeding the current warnings, adopting the prescribed hardening measures, and fostering a culture of continuous vigilance, Washington’s communities—and those across the United States—can better protect the indispensable service of clean, safe water from the growing tide of cyber threats.