title
Cyber Attacks on US Water Purification Plants
Key Takeaways
summary.body
• From July 26th to August 5th, water treatment facilities across multiple US states were targeted by cyber-attacks.
• Some attacks “degraded water operations.”
• Federal law enforcement urged local governments to reinforce security measures.
• Conflicting reports have emerged regarding whether Iranian-backed actors were behind the attacks.
Information Cutoff: August 5th, 2026: 11:15 UTC – 5
Reports have emerged of recent cyber-attacks against US water purification facilities. This blog post details said attacks, outlines the local and federal response to emergent cyber-threats, and investigates claims that Tehran was behind the operation.
sections[0].heading
Incident Report
sections[0].body
Water and Wastewater Services were remotely targeted on July 26th and 27th. Similar incidents have emerged between July 26th and August 5th. Available estimates hold that at least 30 water treatment facilities across multiple US states were targeted by cyber-attacks (1). In the incidents on July 26th and 27th, the attackers allegedly utilized internet-facing devices to access critical Operational Technology (OT), after which they logged administrators out of their accounts before modifying the IP address and password of the facilities (2). These actions were likely intended to deny facility personnel access to critical infrastructure. Subsequent attacks have mirrored this pattern with mixed success. While cyber-operations targeting internet-facing Rockwell PLCs reportedly resulted in erroneous notices calling on the public to boil drinking water before consumption, some local authorities have also noted that, even after attacks, “all systems continued to operate safely” (3).
sections[0].heading
Recommended Countermeasures
sections[0].body
In response to the attacks, the FBI and CISA have recommended the following measures:
- Disconnecting PLCs from the internet;
- Changing facility passwords;
- Restricting access to facility data strictly to registered laptops and computing devices;
- Utilizing physical access keys for sensitive data (a).
sections[0].heading
Suspected Iranian Involvement
sections[0].body
The FBI is currently investigating the cybersecurity breaches and has made no public declaration regarding the culprit. This has not, however, stopped speculation. The New York Times has quoted anonymous sources within the US government as claiming that groups backed by Tehran have emerged as suspects (5). These claims remain low confidence until independently reviewed and confirmed by external experts. However, Iranian involvement in the most recent attack would align with previous instances of Tehran’s cyber-operations against the United States. In 2023 and 2024, for example, the Shahid Kaveh Group – a group likely affiliated with Iran’s Islamic Revolutionary Guard Corps – allegedly targeted energy and water purification infrastructure (6). However, President Trump stated that he “[blamed the attack] on Minnesota and the governor” and that “Iran’s got bigger problems than worrying about Minnesota” (7).
sections[0].heading
Sources
sections[0].body
- https://abcnews.com/US/12-states-face-cyberattacks-water-systems-sources/story?id=135348482
- https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet–facing-programmable-logic-controllers-causing-operational-disruptions
- https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs; https://www.axios.com/2026/08/04/water-cyberattacks-us-iran
- https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs; https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet–facing-programmable-logic-controllers-causing-operational-disruptions
- https://www.nytimes.com/2026/07/30/us/politics/minnesota-water-cyberattack-iran.html
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a
- https://www.youtube.com/watch?v=V6vuYip9SWo
sections[0].heading
Endnotes
sections[0].body
a. For more recommendations, please visit the FBI or CISA’s websites (4).
