Iran-Linked Hackers Hit US Water Systems

A wave of cyberattacks targeting water and wastewater facilities across multiple U.S. states has intensified concerns over the security of America's critical infrastructure. Federal agencies — including the FBI, CISA, the EPA, and the NSA — are investigating the incidents, which disrupted operational technology (OT) systems used to manage water treatment and distribution.

While no official public attribution has been confirmed, government advisories and multiple officials say the attacks closely resemble previous campaigns linked to Iranian-affiliated threat actors.

The attacks reportedly hit more than 30 water systems, with some facilities experiencing temporary disruptions — including altered passwords, changed network settings, compromised software controlling industrial equipment, pressure fluctuations, and localized service interruptions. Authorities confirmed drinking water quality remained safe, and affected utilities switched to manual operations where necessary to maintain service continuity.

Federal advisories indicate Iranian-linked hackers have increasingly targeted internet-connected industrial control systems (ICS), programmable logic controllers (PLCs), and human-machine interfaces (HMIs) used across water utilities, energy providers, and government facilities. Investigators believe attackers exploited exposed, internet-facing operational technology rather than deploying sophisticated zero-day exploits — underscoring how basic infrastructure exposure remains a persistent weak point.

The timing coincides with heightened geopolitical tensions, and the incidents highlight the fragility of essential public services. Many local water utilities run on aging infrastructure with limited cybersecurity budgets, making them appealing targets for state-sponsored actors looking to disrupt services or demonstrate offensive capability. Federal agencies have urged utilities to disconnect unnecessary internet-facing systems, strengthen access controls, implement multi-factor authentication, monitor OT networks continuously, and preserve manual fallback capabilities.

This incident reflects a broader shift in cyber warfare: nation-state actors are increasingly targeting operational technology rather than traditional IT, since disruptions to water, energy, transportation, and healthcare carry immediate real-world consequences. The goal is no longer just data theft — it's undermining public confidence and creating strategic pressure.

For infrastructure operators, cybersecurity must move beyond perimeter defense toward Zero Trust architecture, IT/OT network segmentation, continuous monitoring, AI-driven threat detection, and privileged access management. As geopolitical conflict increasingly plays out in cyberspace, protecting water systems, power grids, and industrial controls has become a core matter of national resilience and public safety.