Why US water systems are vulnerable to foreign cyberattacks

Recent cyberattacks have highlighted the significant vulnerability of U.S. water systems to foreign cyberattacks, raising critical concerns about national infrastructure security. In late July and early August 2026, at least a dozen states experienced disruptions to their water utilities, with over 30 community water systems affected in Minnesota alone. Federal investigators suspect Iran-backed hackers are behind these incidents, noting tactics similar to previous campaigns by the Iran-linked CyberAv3ngers group, which exploited default passwords in water system controllers.

These attacks have exploited longstanding weaknesses in public water systems, particularly the use of poorly secured, internet-connected industrial control systems known as Programmable Logic Controllers (PLCs). Many of these PLCs are reportedly exposed to the public internet with weak or absent passwords, creating easy targets for malicious actors. While incidents have caused issues such as water pressure drops and forced some utilities to issue boil-water advisories and revert to manual operations, officials confirm that the safety of drinking water has not been compromised in these cases.

Experts and officials attribute this widespread vulnerability to years of underinvestment in critical water infrastructure and the fragmented nature of the nation's 148,000 public water systems, many of which lack adequate resources for robust cybersecurity defenses. In response, the FBI, Environmental Protection Agency (EPA), and Cybersecurity and Infrastructure Security Agency (CISA) have issued warnings and guidance, urging utilities to enhance security measures like disconnecting operational programs from the internet, strengthening password protections, and implementing firewalls. There are also calls for increased funding and mandatory security directives to address these persistent threats.