Iran-Linked Hackers Target Water Systems in 12 U.S. States
Cyberattacks targeting programmable logic controllers disrupted water utilities across 12 states, causing pump failures and boil-water advisories while highlighting systemic security gaps in U.S. infrastructure.
A coordinated cyberattack campaign targeted municipal water and wastewater systems across at least 12 U.S. states between July 26 and August 2026. The attacks primarily exploited a critical authentication bypass flaw in Rockwell Automation MicroLogix programmable logic controllers (PLCs) that were connected directly to the internet without passwords or firewalls. The campaign began with a large-scale breach of over 30 systems in Minnesota and expanded to include utilities in Michigan, New Jersey, South Dakota, and Georgia.
Operational impacts included pump station failures, flooding, and loss of water pressure. In Clayton County, Georgia, the Clayton County Water Authority issued a boil-water advisory after a pump station failure affected 300,000 customers. Other disruptions occurred in Braham and Maple Plain, Minnesota, where officials relied on water tower reserves or declared brief states of emergency. Despite these failures, officials confirmed that drinking water safety was not compromised.
U.S. intelligence and cybersecurity firms attribute the activity to CyberAv3ngers, a hacking group linked to the Islamic Revolutionary Guard Corps of Iran. Experts characterize the campaign as a "shot across the bow" intended to create public panic and signal capabilities to the U.S. government. In response, the FBI, EPA, and CISA issued advisories urging utilities to disconnect PLCs from the public internet. The incidents have sparked calls for federal cybersecurity mandates for water utilities, as current protections are largely voluntary. New York Governor Kathy Hochul announced $9 million in grants to strengthen defenses, while Senator Adam Schiff proposed legislation to expand EPA authority over water sector security.
