Hackers Target Drinking Water Systems Across 12 US States as Small Towns Emerge as the Weakest Link

Hackers have targeted drinking water and wastewater systems across at least 12 US states, exposing the vulnerability of small communities operating ageing equipment with limited cybersecurity resources.

Two municipal water systems in New Jersey were among the latest targets, while more than 30 utilities were reportedly attacked in Minnesota. Nine systems in Michigan also experienced attempted or successful breaches.

Federal authorities are investigating whether the incidents are part of a coordinated campaign. Iran is reportedly considered the leading suspect, but the FBI has not publicly attributed the attacks to any country or organisation.

Hackers Lock Operators Out

The attackers reportedly accessed internet-connected systems used to monitor and control water infrastructure.

In some cases, they changed passwords and locked employees out of equipment responsible for managing treatment operations. Several utilities disconnected affected technology and switched to manual controls as a precaution.

One system in Braham, Minnesota, temporarily stopped operating after hackers interfered with its controls. Other affected communities reported communication problems, water-pressure disruptions or precautionary boil-water notices.

Officials said no contaminated water had reached the public. Most systems continued operating safely or restored services quickly after isolating the compromised equipment.

The Cybersecurity and Infrastructure Security Agency, FBI and Environmental Protection Agency are assisting state and local authorities.

Older Systems Leave Towns Exposed

Many smaller water utilities depend on older technology that was installed before modern cyber threats became a major concern.

Industrial control devices may be connected to the internet so employees can monitor pumps, pressure and chemical levels remotely. While this can improve efficiency, weak passwords and outdated software can provide hackers with an entry point.

Small utilities may employ only a handful of workers and lack full-time cybersecurity specialists. Replacing equipment or conducting regular security testing can also be difficult when local budgets must cover maintenance, staffing and water-quality requirements.

This makes them easier targets than major city systems protected by larger technology and security teams.

The attacks may not have required highly sophisticated methods. Investigators are examining whether hackers exploited systems that still used default credentials or other widely known weaknesses.

Suspicion Falls on Iran

Unnamed US officials reportedly believe actors connected to Iran may be responsible, amid continuing military and political tensions between Tehran and Washington.

Iran-linked groups have previously targeted water infrastructure. In 2023, hackers compromised equipment at a Pennsylvania utility because it used technology manufactured in Israel.

However, no group has claimed responsibility for the latest campaign, and investigators have not presented public evidence establishing Iran's involvement.

The absence of ransom demands has strengthened suspicions that disruption, rather than financial gain, was the objective. That alone does not identify the attackers.

Safeguards Against Contamination

Water systems use digital controls to regulate pumps, pressure and the chemicals added during treatment. If attackers gained sufficient access, they could potentially interrupt supply or alter operations.

Utilities also maintain physical safeguards, water-quality testing and manual controls designed to prevent unsafe water from reaching customers.

The latest breaches caused limited disruption and no confirmed contamination. Nevertheless, a campaign reaching at least 12 states shows how weaknesses in small local systems could create a wider national-security risk.

Federal agencies have urged utilities to remove unnecessary internet connections, change default passwords and prepare to operate equipment manually.