More than 100 water systems were hit in July cyberattacks
US authorities said that more than 100 internet-exposed water and wastewater systems were targeted in cyberattacks during July, highlighting a broad weakness in critical infrastructure rather than isolated incidents. The attacks matter because many affected systems use industrial controllers that were not designed to be accessible from the public internet, raising concerns that the activity could be preparation for more disruptive operations.
CISA said attackers commonly targeted programmable logic controllers connected directly to cellular modems, with mostly small rural utilities affected in at least 12 states, including Minnesota, Michigan, Georgia, South Dakota and New Jersey. Analysts suspect Iranian-linked actors, but the US government has not made a formal attribution; CISA urged operators to remove PLCs from direct internet access, use VPNs or gateways for remote connections, protect accounts and replace default passwords.
- Over 100 US water systems faced cyberattacks in July.
- Internet-exposed industrial controllers were a common target.
- Officials advised stronger remote-access protections.
New here? Start with this
Water and wastewater utilities use industrial controllers to operate equipment such as pumps and treatment processes. Some controllers can be monitored or adjusted remotely, but connecting them directly to the public internet can leave them exposed to people trying to gain access.
The systems described are mainly small, rural utilities, which provide essential services to local communities. US officials have warned about the security risk, while analysts have suggested a possible link to Iranian-backed groups; no formal attribution has been made. If access to a controller is misused, it could disrupt water services or affect how a system operates.