Multistate Water System Attacks Widen, Iran Suspected

Multiple US states are reporting a widening wave of cyber attacks against water infrastructure, with Iranian threat actors suspected as the perpetrators. According to industry reports, the intrusions target Internet-exposed Programmable Logic Controllers (PLCs) at water utilities. The PLCs are described as ill-secured, often running default credentials or known vulnerable firmware, making them susceptible to unauthorized access and manipulation. The attacks are ongoing as of August 10, 2026, and span across a dozen states. While the full extent of compromised systems and the specific impact on water supply operations are still being assessed, the intrusions represent a significant threat to critical infrastructure and public safety. Authorities have not released technical details of the exploits used, but the reported methods align with the exploitation of poorly secured OT/ICS devices connected to the public internet. The attribution to Iran is based on intelligence assessments, though such attributions are often provisional and subject to further validation. The incidents underscore the persistent risk posed by internet-facing operational technology assets in the water sector.