More than 100 water systems were hit in July cyberattacks

In July 2026, over 100 internet-exposed water systems across at least a dozen US states were targeted by cybercriminals. This marks the first time the US government has disclosed a specific number of such digital intrusions, although they have yet to attribute the campaign to a specific group, widely suspected to be linked to Iran.

The Cybersecurity and Infrastructure Security Agency (CISA) revealed that the attacks often involved programmable logic controllers (PLCs) connected directly to a cellular modem, a practice that can create significant security risks. Small, rural utilities in Minnesota, Michigan, Georgia, South Dakota, and New Jersey were hit the hardest.

Matt Hartman, former acting head of cyber at CISA, emphasized the seriousness of the situation, stating that the scale of the attack highlights a systemic vulnerability in the water sector. While 100 systems represent only about 0.5 percent of US water utilities, the threat is that these attacks could be a precursor to larger-scale assaults.

In response to the incidents, CISA recommended that organizations disconnect PLCs from the internet, use VPN or gateway devices for remote access, enable password protection, and implement multi-factor authentication. The US federal government has not publicly attributed the attacks to any particular entity, acknowledging the difficulty in attribution due to adversaries' tactics.