12-State Water Hack — Who’s Behind It?

The most fragile part of America’s infrastructure is now under quiet attack: the taps in your kitchen sink.

Story Snapshot

Hackers have hit water systems in at least 12 states, forcing some utilities into manual mode.
Federal agencies warn of an ongoing Iranian-affiliated cyber threat aimed at water and wastewater systems.
Investigators and intelligence officials see Iran-linked hackers as the leading suspects, but attribution is still unfolding.
Drinking water remains safe so far, though some communities have faced pressure problems and boil-water notices.

A coordinated campaign against small-town water

Hackers have targeted water and wastewater utilities in at least a dozen states, turning routine local systems into the front line of a global cyber struggle. Federal investigators say the attackers are breaking into the control technology that runs pumps, valves, and water pressure, sometimes locking operators out by changing passwords and network settings.

In plain terms, they are grabbing the remote controls for the machinery that keeps water flowing, then forcing staff to fall back to manual operations.

The campaign began to draw national attention when Minnesota reported that more than 30 municipal water systems were hit in a coordinated strike. State officials said hackers aimed at about 36 systems, targeting hardware that controls wells, towers, and wastewater lift stations.

The Federal Bureau of Investigation (FBI) later confirmed that at least seven states had already seen similar cyberattacks since late July, with some of that activity degrading water operations. That early wave is now understood as the opening salvo of a broader, 12-state campaign.

Why Iran is at the top of the suspect list

Multiple U.S. officials and security sources say Iran-linked hackers are the prime suspects behind the water system intrusions. Their view is shaped by technical clues and history, not guesswork.

Federal advisories in recent years have warned that Iranian-affiliated actors, including groups tied to the Islamic Revolutionary Guard Corps, have repeatedly targeted the same types of industrial control devices at U.S. water and wastewater facilities.

Analysts describe the current tactics as matching that earlier playbook, including attacks on internet-facing programmable logic controllers.

The Environmental Protection Agency, FBI, Cybersecurity and Infrastructure Security Agency, and National Security Agency issued a joint advisory saying U.S. drinking water and wastewater organizations are facing urgent exploitation and, in some cases, disruption of their operational technology by Iranian-affiliated cyber actors.

Intelligence officials told reporters they believe Iran is “likely responsible” for the Minnesota attacks, based on the lack of ransom demands, the focus on physical infrastructure, and similarities to past Iranian campaigns. This fits a pattern: a hostile regime testing America’s vital systems without firing a shot.

What has – and has not – happened to the water itself

Despite the scale of the hacking campaign, federal and state officials say there is no confirmed contamination of drinking water at any affected utility so far. In several states, operators lost remote monitoring or automatic control, which caused drops in pressure, localized flooding, or the need to switch pumps and valves to manual mode.

Some communities issued precautionary boil-water notices after pressure problems, following standard safety rules rather than reacting to evidence of poisoning. Michigan authorities stressed that all systems continued to operate safely and that there were “no known impacts” posing a public health concern.

The real damage, for now, is operational and psychological. Local crews have had to scramble to restore control and rebuild trust while residents see scary headlines about foreign hackers and their drinking water.

A few utilities temporarily shut down treatment plants or disconnected vulnerable devices from cellular networks, trading convenience for safety.

For many, this was a harsh lesson that basic cyber hygiene on small-town equipment is now a matter of national security, not just IT housekeeping.

The weak link in America’s critical infrastructure

These attacks highlight a long-standing weakness: thousands of small water systems run critical equipment that is connected to the internet yet poorly protected. Federal agencies have been warning about this for years, saying that cyberattacks pose “a serious concern” for water utilities and that Iran-affiliated actors are actively exploiting those gaps.

Many of the devices under attack use factory-default passwords or outdated software, making them easy targets for any determined adversary with a search engine and patience.

Recent cyberattacks have targeted municipal water and wastewater systems across multiple U.S. states, with evidence increasingly pointing to Iran-linked actors.

In late July 2026, hackers struck more than 30 community water systems in Minnesota (including temporarily taking one… pic.twitter.com/7RstL3p44M

— Jan (@Jan812314) August 6, 2026

One new report notes that a volunteer hacker program designed to help small utilities fix these weaknesses has only reached a tiny fraction of the roughly 50,000 systems nationwide. That mismatch between the size of the problem and the scale of the response should ring alarm bells for any taxpayer who expects reliable water at home.