Key Takeaways
- Recent cyber intrusions have hit water and wastewater utilities in at least seven U.S. states, with investigators probing possible Iranian involvement amid rising U.S.-Iran tensions.
- Water systems are essential to drinking supplies, food production, semiconductor manufacturing, and data‑center cooling, yet they remain under‑protected compared with energy grids and IT networks.
- Feras Batarseh, Virginia Tech associate professor of biological systems engineering, stresses that water security is national security and warns that agriculture is becoming the fastest‑growing cybercrime target.
- Smaller municipal utilities often lack the resources to hire dedicated cybersecurity staff, leaving them especially vulnerable to state‑sponsored or criminal attacks.
- Because data centers rely heavily on water for cooling, an attack on water supplies could cripple critical computing infrastructure, a risk that is particularly acute in Virginia’s data‑center‑dense corridor.
- Proactive cybersecurity planning—such as building redundant operations, alternative water sources, and backup power—must occur before attacks happen, not after.
- Batarseh’s fieldwork in Qatar under a Fulbright scholarship demonstrated that physical assaults on critical infrastructure are routinely preceded by cyberattacks aimed at disruption or disablement.
- Experts urge investment in structural safeguards, AI‑driven monitoring, and policy reforms to strengthen the cyberbiosecurity of water and agricultural systems nationwide.
Recent Cyber Intrusions Target U.S. Water Utilities
In the past few months, cyber intrusions have struck water and wastewater utilities across at least seven U.S. states, prompting federal investigations that are exploring whether Iranian actors are behind the attacks. The incidents come amid heightened geopolitical tension between the United States and Iran, illustrating how state‑sponsored cyber operations are increasingly used as a prelude to—or substitute for—physical aggression. While much of the public discourse focuses on breaches of energy grids and corporate IT networks, these water‑sector intrusions reveal a quieter but equally dangerous front in modern cyber warfare.
Water Security Equals National Security
Feras Batarseh, an associate professor of biological systems engineering at Virginia Tech, argues that water security should be treated as a core component of national defense. He points out that water underpins drinking supplies, irrigation for food production, semiconductor fabrication, and the cooling systems that keep data centers operational. Despite its pervasive importance, water infrastructure receives far less cybersecurity attention and funding than the energy sector, leaving a critical gap that adversaries can exploit.
Lessons from the Field: Qatar Fulbright Experience
Batarseh’s firsthand exposure to the intertwining of cyber and physical threats came during a Fulbright‑sponsored research stint in Qatar, where he studied water and agricultural security. When a regional conflict erupted, his team’s work shifted from academic inquiry to real‑world crisis response. On the ground, he observed that virtually every physical attack on critical infrastructure was preceded by a cyberattack designed to disrupt or disable services, even when no rockets or drones were ultimately launched. This pattern reinforced his conviction that defending against cyber incursions must precede any physical contingency planning.
Agriculture Emerges as a Top Cyber Target
Among the sectors Batarseh monitors, agriculture has shown the fastest rise as a target for cybercriminals and state‑sponsored actors. Modern farms rely on networked sensors, automated irrigation, and data‑driven decision‑making tools, yet many of these systems run on legacy hardware with minimal security patches. Because the agricultural sector is diffuse—comprising thousands of small operations—it presents a broad attack surface that is often overlooked in national cybersecurity strategies, making it an attractive vector for adversaries seeking to destabilize food supplies.
Resource Gaps in Small Municipal Utilities
Large municipal water systems may have the budget to employ a dedicated chief information security officer (CISO) or to invest in advanced threat‑detection platforms, but the majority of the nation’s water utilities are small, rural, or municipally run entities with limited technical staff and financial reserves. Batarseh notes that these smaller systems frequently lack basic cyber hygiene measures such as multi‑factor authentication, network segmentation, or regular vulnerability assessments, leaving them exposed to ransomware, data manipulation, or service‑disruption attacks that could cascade into public health emergencies.
Data Centers and the Water‑Cooling Vulnerability
Virginia’s reputation as a hub for data centers amplifies the risk posed by water‑targeted cyberattacks. Massive server farms depend on continuous supplies of cool water to prevent overheating; any interruption—whether through contamination, flow reduction, or system shutdown—can cause hardware throttling, service outages, or even permanent damage. Batarseh warns that adversaries could aim to compromise the water‑treatment or distribution networks that feed these facilities, turning a seemingly unrelated water utility breach into a direct strike on the nation’s digital infrastructure.
The Need for Proactive, Redundant Defense
Reacting after an attack has occurred is far costlier and less effective than building resilience beforehand. Batarseh advocates for a cybersecurity strategy that emphasizes alternative operations, backup water sources, and isolated control‑system architectures before threats materialize. Investments in structural redundancy—such as dual‑feed pipelines, on‑site storage tanks, and micro‑grid‑capable power supplies—can maintain essential services even when primary cyber‑defenses are breached. Moreover, integrating artificial‑intelligence‑based anomaly detection can provide early warning of irregularities in flow rates, chemical dosing, or pressure readings that might signal a cyber intrusion.
Policy, AI, and the Path Forward
Beyond technical fixes, Batarseh calls for updated public‑policy frameworks that recognize water and agricultural systems as critical infrastructure deserving of the same cybersecurity rigor applied to the power grid. He highlights ongoing research at Virginia Tech that leverages AI to model water demand under drought conditions, detect anomalous sensor behavior, and assure the integrity of autonomous irrigation controls. By coupling AI assurance algorithms with robust regulatory standards, policymakers can help close the security gap that currently leaves vast swaths of the nation’s water supply exposed.
About Feras Batarseh
Feras Batarseh is an associate professor of biological systems engineering at Virginia Tech. His research focuses on artificial intelligence assurance, intelligent water systems, cyberbiosecurity, and AI for agriculture policy. Through his lab, he develops AI‑driven applications and assurance algorithms aimed at addressing persistent challenges in water security and agricultural public‑policy outcomes. He is frequently consulted on topics ranging from the cyber‑threat landscape for municipal utilities to the role of AI in safeguarding food production.
Interview Availability
Batarseh is available to speak with media about why agriculture and municipal water systems are increasingly attractive targets for cybercriminals and state‑sponsored actors, and why smaller water utilities remain dangerously under‑fortified. Journalists interested in arranging an interview should contact the Virginia Tech media relations office at [email protected].