U.S. Agencies Warn of Iranian Cyberattacks on Water Utilities

The Cybersecurity and Infrastructure Security Agency (CISA), FBI, and Environmental Protection Agency issued a joint warning on July 31, 2026, following a surge of cyberattacks targeting water and wastewater systems across the United States. Since July 27, utility companies in at least seven states have reported incidents involving the targeting of programmable logic controllers (PLCs). Federal investigators believe Iranian-linked hackers are responsible for the campaign, which coincides with intensified direct fighting between the United States and Iran in the Middle East.

In Minnesota, over 30 municipal water systems were targeted between July 26 and 27. The attacks focused on operational technology used to remotely monitor and control water towers and lift stations. While officials confirmed that water supplies remained safe, the city of Braham experienced a two-hour outage of its treatment plant, and other cities, including South St. Paul, Plymouth, and Maple Plain, relied on manual workarounds. Some attacks nationwide caused flooding and loss of water pressure after hackers changed passwords to lock out operators.

Federal agencies are examining whether vulnerabilities in Rockwell Automation MicroLogix 1400 PLCs provided a common entry point for the attackers. CISA has urged critical infrastructure operators to remove publicly exposed PLCs from the internet and maintain manual operation capabilities to prevent further disruptions.