Victims told the FBI they were experiencing flooding and loss of water pressure due to the hacks.
Hackers are targeting critical infrastructure in the US, the FBI and the Environmental Protection Agency (EPA) warn in a <a href="https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet–facing-programmable-logic-controllers-causing-operational-disruptions” rel=”nofollow noopener” target=”_blank”>public service announcement. Seven water and wastewater utility companies have already been hit by cyberattacks since July 27, 2026, which led to degraded water operations. The FBI has revealed in its PSA that the bad actors are infiltrating systems by targeting, in particular, Programmable Logic Controllers (PLCs). They remotely access internet-facing devices and then go in to change IP address and passwords, preventing the utilities from being able to monitor and control their operations.
Authorities are now advising utility companies to use secure gateway and firewalls to protect their systems from direct internet exposure. They’re also advising the utilities to set up stronger passwords and utilize access control lists to only allow authorized communications between system devices. The FBI said it has gotten reports of loss of pressure and flooding due to the cyberattacks. It warned that pressure loss in water systems could lead to untreated ground water seeping into pipes, which translates into much larger impact to the victims’ operations than just low water pressure.
The FBI’s warning comes after more than 30 municipal water facilities in Minnesota were infiltrated by bad actors over the past week. According to NBC News, the attacks in Minnesota had all the hallmarks of Iranian meddling. Law enforcement is still investigating the incidents and has yet to confirm if the country is truly involved, but Wired has reported seeing a memo that ties the Minnesota attacks to Iran.
The memo was sent to members of the Water Information Sharing and Analysis Center (WaterISAC), an industry group for water utilities. In it, WaterISAC reportedly said that the the Minnesota Fusion Center, a state-level intelligence-sharing entity, issued a warning that the “ongoing malicious cyber activity impacting public drinking water systems across Minnesota” aligned with a hacking campaign that CISA previously described. The US Cybersecurity and Infrastructure Security Agency (CISA) issued its own warning back in April that “Iran-affiliated” hackers were targeting water infrastructure, among other entities.
