FBI warns cyberattacks hit 7 US water utilities since July 27

Cyberattacks disrupted water and wastewater operations in seven U.S. states starting July 27, 2026, causing flooding and loss of water pressure, the FBI and Environmental Protection Agency said in a joint advisory issued August 1.

The hackers targeted programmable logic controllers (PLCs) by remotely accessing devices connected to the internet, then changed IP addresses and passwords to shut operators out of monitoring and control systems, the FBI added.

Untreated groundwater could seep into pipes if pressure drops, the agency warned, posing broader public health and operational risks.

The advisory urged utilities to install secure gateways and firewalls, enforce stronger passwords, and use access control lists to limit communications between devices.

A separate wave of intrusions hit more than 30 municipal water facilities in Minnesota in late July 2026. NBC News reported that those attacks bore hallmarks of Iranian involvement. Wired saw a memo from the Water Information Sharing and Analysis Center (WaterISAC) saying the Minnesota Fusion Center had warned the activity matched an Iranian hacking campaign previously described by the Cybersecurity and Infrastructure Security Agency (CISA). CISA had cautioned in April 2026 that Iran-affiliated hackers were targeting water infrastructure.

The FBI and EPA are still investigating the seven-state attacks and have not attributed them to a specific actor, while law enforcement has yet to confirm Iranian involvement in the Minnesota incidents.