Cyberattacks targeting U.S. drinking water and wastewater systems were reported across at least 12 states in July and August 2026, with attackers remotely accessing internet-facing industrial controllers used to monitor and operate water infrastructure. In some utilities, the incidents disrupted remote controls and forced operators to switch to manual operation; a cyber incident at Clayton County Water Authority in Georgia contributed to a pressure drop and a precautionary boil-water advisory. Officials said drinking water remained safe in the reported attacks.
Federal investigators suspect that some of the activity may be connected to Iran-backed actors, although they had not formally attributed the July attacks at the time of reporting. For security leaders, the story is bigger than who was behind them. Water systems show what cyber resilience looks like when digital controls meet physical infrastructure, stretched operational teams, third-party configurations, and the need for people who can keep essential services running when the screens stop cooperating.
What happened in the 2026 U.S. water utility cyberattacks?
The FBI and EPA warned on July 30 that malicious actors had targeted internet-facing programmable logic controllers, or PLCs, at water and wastewater utilities in at least seven states since July 27. The affected devices included Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 controllers, which can perform functions such as monitoring pumps, valves, pressure, and other industrial processes.
Attackers remotely accessed exposed devices and changed IP addresses and passwords, causing utilities to lose monitoring or control functionality. The FBI said reported operational effects included loss of water pressure and flooding, and some utilities had to move to manual operation while systems were recovered. By August 6, CBS News reported attacks or suspected activity across at least 12 states, including more than 30 community water systems in Minnesota.
One of the most visible incidents occurred at Clayton County Water Authority in Georgia, which serves roughly 300,000 customers. Cyber activity contributed to a pressure drop, and the utility issued a boil-water advisory while service was restored. Authorities said the reported attacks had not contaminated drinking water.
The federal concern did not appear out of nowhere. In April, the EPA, FBI, CISA, and NSA had already issued a joint advisory warning about ongoing Iranian-affiliated activity against U.S. organizations, including drinking water and wastewater systems. That earlier activity had included configuration wiping, sensor tampering, and disruption of human-machine interfaces.
There is an attribution wrinkle worth keeping straight. Federal agencies explicitly connected the April threat warning to Iranian-affiliated actors. Investigators said the later July attacks resembled previous Iranian-linked activity, but CBS reported that there had not yet been a formal attribution. “Possibly linked” is doing important work here.
Why are water utilities vulnerable to cyberattacks?
Water infrastructure has become increasingly connected because remote monitoring and control are genuinely useful. Utilities may manage equipment spread over large geographic areas, and being able to see what a pump or treatment process is doing without physically standing beside it has obvious operational benefits.
The trouble starts when operational technology that was never designed with today’s threat environment in mind becomes directly reachable from the public internet. CBS reported that some affected PLCs had weak or absent password protection and lacked basic network barriers such as firewalls or secure gateways. The FBI consequently advised utilities to remove PLCs from direct internet exposure, use strong unique passwords, tightly control network access, secure cellular connections, and review connected devices for suspicious activity.
It is tempting to look at a default password and declare this a simple case of somebody failing Cybersecurity 101. Critical infrastructure rarely gives us anything quite that tidy. Water systems can include old equipment, specialist vendors, remote sites, inherited configurations, limited technical teams, and operational requirements where availability is every bit as important as confidentiality. The FBI also noted similarities in network configurations provided by third parties across several victims, suggesting that one vulnerable setup can sometimes be reproduced across multiple customers.
That is exactly the kind of systems thinking behind our article Rethinking Human Risk: It’s Not What You Think. A risky condition may eventually show up as a password, a configuration, or an operator action, but understanding why it exists usually requires looking at the technology, workload, suppliers, operating practices, incentives, ownership, and organizational environment around it.
The human risk inside operational technology
The most interesting human story in these attacks may be what happened after the technology failed.
Several utilities were able to move affected processes into manual operation and regain control. The FBI now explicitly recommends that critical infrastructure operators practice and maintain the ability to operate OT systems manually, including routinely testing business continuity plans, backups, fail-safe mechanisms, and standby systems.
That is human resilience in a very practical form. Operators need enough system knowledge to recognize when digital information can no longer be trusted, understand the physical process underneath the interface, make safe decisions without the usual automation, communicate with other teams, and restore service without creating a second problem while fixing the first.
There is a competency risk here that deserves more attention as industrial systems become more automated. The easier technology makes normal operations, the less frequently people may need to practice the manual skills required during abnormal ones. If those capabilities are only discovered during an incident, the recovery plan has become an experiment conducted on live infrastructure.
Culture matters as well. OT security crosses operations, engineering, IT, cybersecurity, vendors, management, and sometimes local government. Weak signals have to move between those groups, unusual behavior has to be reported quickly, and somebody needs enough authority to disconnect a system or change how work is being done when safety requires it. Our piece Security Culture Is a System, Not a Vibe explores why security culture lives in those everyday expectations, responsibilities, and decisions rather than posters about being cyber aware.
What should water utilities and critical infrastructure operators do now?
The federal guidance is refreshingly practical. Internet-facing PLCs should not be sitting directly on the public internet when secure gateways and network controls can mediate access. Default or weak credentials need to go, remote connections need stronger authentication, logs need to be reviewed, and communications to industrial controllers should be restricted to systems that genuinely need them. The FBI also recommends checking controller project files for unauthorized changes and validating backups before using them for recovery.
For the human side, utilities should know who can change OT configurations, who owns remote-access decisions, which vendors can connect to equipment, and how unusual activity gets escalated outside normal working hours. Incident exercises should include the people who actually operate the physical process rather than remaining entirely inside the cybersecurity team.
Manual operation deserves rehearsal too. A written recovery procedure is useful, but a practiced operator is considerably more useful at 2:00 a.m. when a controller has stopped responding. That means maintaining operational competence alongside cyber competence and making sure succession, contractor dependence, and staffing changes do not quietly leave critical knowledge concentrated in one person.
The EPA makes a useful point for smaller utilities: many meaningful cybersecurity improvements are procedural rather than dependent on an enormous new technology budget. Better access practices, incident reporting, configuration management, training, exercises, and clear ownership can materially improve resilience even where resources are constrained.
Why these attacks matter beyond the water sector
Water is what cybersecurity people rather dryly call a “lifeline” sector. Hospitals, businesses, manufacturing, schools, fire services, households, and other infrastructure all assume that clean water and adequate pressure will be available.
That makes relatively modest disruption capable of creating consequences elsewhere. A few hours of lost remote control at a municipal utility sounds quite different when the same water system also supports a hospital, industrial facility, or emergency response network.
It also puts public communication into the resilience plan. Utilities have to explain what happened, whether water remains safe, whether customers need to take precautions, and when normal service is expected to return. Technical recovery and public trust are happening at the same time, often while the investigation is still producing new information.
Critical infrastructure cyber resilience therefore has a substantial human component: operators who can recover safely, managers who can make decisions with incomplete information, security teams that can interpret unfamiliar OT behavior, vendors who understand their responsibilities, and communications teams that can tell the public what they actually need to know.
A password problem feels rather less like a password problem once it can affect water pressure.
The Cybermaniacs take
The 2026 water utility attacks show why the old habit of separating “cyber” from “operations” becomes increasingly unhelpful in critical infrastructure. The digital environment is part of the physical operating environment now, and the people responsible for each need to understand enough about the other to respond when something crosses the boundary.
They also show why Human Risk Management should not be shorthand for phishing training. Human risk can sit in a vendor configuration that has been repeated across sites, an unclear responsibility for reviewing remote access, a team that has not practiced manual recovery recently, or a culture where operational and security information travels too slowly between functions.
The technology controls matter enormously; many of the mitigations in the FBI guidance are straightforward technical hygiene. Human resilience determines how well the organization notices a problem, interprets it, responds to it, works safely around it, and learns enough afterward to make the next incident less disruptive.
That wider relationship between systems and behavior is also why Cybermaniacs argues for treating culture as part of security infrastructure rather than a soft program sitting beside it. In critical infrastructure, the distinction stops being theoretical fairly quickly.
How Cybermaniacs can help
Cybermaniacs helps organizations understand the human factors shaping cyber resilience across competency, behavior, psychology, culture, organizational conditions, and the realities of how work gets done. Our Human Risk Baseline goes beyond training completions and phishing metrics to identify where workforce risk exists, what is contributing to it, and where targeted intervention can make a difference.
For organizations building or maturing the wider capability, HRM Advisory & Program Management connects human-risk strategy with governance, measurement, culture, learning, communications, engagement, and ongoing program operations. Cybermaniacs also supports continuous cybersecurity awareness and competency development, policy training, phishing and social-engineering resilience, champions programs, targeted campaigns, and executive assurance.
Critical infrastructure will never be protected by training alone, and nobody serious is suggesting it should be. The useful question is whether the people operating, supporting, securing, and governing those systems are as prepared for failure as the technology around them is supposed to be.
FAQ
What happened in the 2026 U.S. water utility cyberattacks?
Water and wastewater utilities across at least 12 U.S. states reported cyberattacks or suspected malicious activity in July and August 2026. Attackers remotely accessed internet-facing industrial controllers at some utilities, causing loss of monitoring or control and, in some cases, operational disruption.
Were the U.S. water system attacks linked to Iran?
Federal investigators suspected that the July attacks may have been connected to Iran-backed hackers, but had not formally attributed them at the time of reporting. An earlier April 2026 government advisory separately warned of confirmed Iranian-affiliated cyber activity targeting U.S. organizations, including water and wastewater systems.
Was drinking water contaminated by the cyberattacks?
Officials said the reported July attacks had not affected drinking-water safety. Clayton County Water Authority experienced a pressure drop and issued a precautionary boil-water advisory, but service was restored within hours.
How did hackers access water utility systems?
The FBI said attackers targeted internet-facing programmable logic controllers and changed device configurations, including IP addresses and passwords. Federal guidance recommends removing PLCs from direct internet exposure, strengthening authentication, restricting network access, and monitoring connected systems.
Why did some water utilities switch to manual operations?
Cyber activity caused some utilities to lose remote monitoring or control functionality. Operators were able to switch processes to manual control while affected technology was isolated and restored. The FBI recommends that critical infrastructure organizations routinely practice manual operation as part of business continuity and disaster recovery.
Why are water utility cyberattacks a human risk issue?
Water-system resilience depends on more than technical defenses. Operators, security teams, engineers, managers, and vendors need appropriate competency, clear responsibilities, practiced escalation and recovery procedures, secure working norms, and the ability to operate safely when automated systems become unavailable.
How can water utilities improve cyber resilience?
Federal guidance emphasizes removing industrial controllers from direct internet exposure, using strong unique passwords, restricting access, monitoring logs, validating configurations and backups, securing remote connectivity, reporting incidents quickly, and regularly practicing safe manual operation.