In late July 2026, attackers hit more than 100 U.S. water and wastewater systems in at least 12 states in a few weeks. Minnesota alone reported more than 30. The FBI and EPA issued a public alert on July 30.
What happened
The attackers did not break anything clever. They found control equipment — mostly Allen-Bradley MicroLogix controllers — that could be reached directly from the internet, often through a cellular modem at a remote site. They changed the passwords and network settings, which locked operators out of their own systems.
Some utilities lost pressure, some reported flooding, and some issued boil-water notices while staff ran things by hand. No contamination of drinking water has been confirmed.
Who did it
Nobody has officially said. Federal agencies have separately confirmed that an Iranian-linked group is targeting water controllers, but they have not tied July to that group. Be wary of anyone who tells your board otherwise.
Who did it changes the headline. It doesn't change the fix.
What to check this month
- Can any controller, operator screen or cellular modem be reached straight from the internet?
- Has every default password been changed, including at remote sites?
- Could your staff run the plant by hand for three days if the controls were locked?
- Are you enrolled in CISA's free Cyber Hygiene scanning? It checks exactly this.
What it costs
The first checks cost almost nothing. Fixing what they turn up — separating networks, securing remote access, adding monitoring — is the work state and federal programs are designed to fund. A written assessment is usually the first step, because it's what the funding applications ask for.