Rising Cyberattacks On U.S. Water Infrastructure: Federal Guidance And Next Steps For Operators

Key Points:

• Cyberattacks on water utilities are on the rise, with utility companies in at least seven states reporting incidents affecting water operations to the Federal Bureau of Investigation (“FBI”) since July 27, 2026.
• The FBI, Environmental Protection Agency (“EPA”), and Cybersecurity and Infrastructure Security Agency (“CISA”) recommend taking immediate action: remove programmable logic controllers (“PLCs”) from direct internet exposure, change default passwords, and route remote access through virtual private networks (“VPNs”) or gateways.
• Utilities should review their incident reporting obligations under various regulatory regimes, including the Safe Drinking Water Act and pending regulations under the Cyber Incident Reporting for Critical Infrastructure Act (“CIRCIA”), which are expected to be finalized in September 2026.

Recent guidance issued by Federal agencies warns that malicious cyber actors are targeting internet-facing operational technology (“OT”) used by water and wastewater utilities, particularly PLCs. Since July 27, 2026, water and wastewater utilities in at least seven states have reported incidents to the FBI, and some of that activity has degraded water operations. CISA separately stated that it sees a significant increase in threat actors targeting PLCs in the water and wastewater systems sector and that the cyberattacks have caused water systems to issue boil water notices and implement manual operations.

The reported attack pattern has been the same in each instance; it is straightforward but operationally serious. Attackers remotely access exposed PLCs, change IP addresses and passwords, and thereby cause loss of monitoring, loss of control functionality, operator lockout, and in some cases, loss of function of connected equipment. The FBI reported operational effects including loss of pressure and flooding, and warned that pressure loss could potentially allow untreated groundwater to seep into pipes. CISA has warned that internet-exposed OT assets face increased risk of defacement, configuration changes, operational disruption, and, in severe cases, physical damage. CISA’s broader PLC advisory describes related activity in which attackers modified or deleted project-file logic, manipulated human machine interface (“HMI”) and supervisory control and data acquisition (“SCADA”) display data, and disabled critical shutdown and alarm logic, creating unsafe conditions without notifying operators.

Attribution and Threat Context

The FBI/EPA issued a joint Public Service Announcement, which refers to “malicious cyber actors” but does not attribute the July 2026 water-sector activity to a named country or group. Media reports, however, have framed the activity as a multi-state critical infrastructure concern, and some have reported suspected Iranian involvement in certain attacks. In Minnesota, a coordinated attack on more than 30 municipal water systems on July 26 and 27 forced one treatment plant offline for a few hours. In addition, news outlets reported on August 13 that APT IRAN and the CyberAv3ngers, two hacking groups linked to Iranian-affiliated threat actors, have claimed responsibility for “the attack on Minnesota.” CISA’s July 22 advisory describes Iranian-affiliated cyber actors exploiting PLCs across U.S. critical infrastructure, including water and wastewater systems, government services, and energy. The Iranian-affiliated threat actors, who have bene identified as affiliates of the Islamic Revolutionary Guard Corps (“IRGC”), appear to have exploited devices that retained default credentials or lacked adequate network segmentation, underscoring the importance of basic cyber hygiene measures for critical infrastructure operators.

Federal Guidance on Incident Response

Federal agency guidance for water utilities that may be targeted by these cyberattacks focuses on a few key action items: 

• Remove PLCs and other OT from direct public internet exposure. FBI/EPA guidance advises utilities to remove inbound port exposure so OT systems are not directly exposed to the internet or external networks. Utilities should mediate, monitor, and control remote access through a secure gateway or jump host. CISA similarly recommends that remote access for operational purposes go through a VPN or gateway device rather than directly to the PLC. 
• Enable password protection and change default passwords. Utilities should ensure device passwords are complex, unique combinations of letters, numbers, and symbols. After disconnecting PLCs from the internet, operators should ensure they have a known clean backup of the PLC image in case they are locked out by a modified password.
• Configure firewall rules and restrict remote access to critical systems. Utilities should strictly control network access to PLCs by configuring firewall rules or access-control lists to allow only authorized communications between expected control-system devices. CISA specifically recommends not listing IP addresses so that remote access is limited to known engineering laptops or other critical OT assets.
• Secure modems and regularly utilize logs. The FBI/EPA guidance recommends securing cellular modems used for remote field connectivity with strong authentication and updates. Utilities should enable logs for connected modems and regularly review those logs for suspicious activity.
• Practice and maintain the ability to operate OT systems manually. Routine testing and maintenance of business continuity and disaster recovery plans, fail-safe mechanisms, islanding capabilities, software backups, and standby systems will help ensure safe manual operations in the event of an incident. 

Regulatory Compliance and Reporting Considerations

Water and wastewater utilities should also be aware that these cybersecurity incidents may trigger reporting and compliance obligations under federal and state law. Under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”), covered entities in critical infrastructure sectors—including water and wastewater systems—will be required to report substantial cyber incidents to CISA within 72 hours and ransomware payments within 24 hours once final implementing regulations take effect, expected in September 2026.

The EPA also has authority under the Safe Drinking Water Act to require community water systems serving more than 3,300 people to conduct risk and resilience assessments that address cybersecurity threats and to develop or update emergency response plans accordingly. Utilities should consult with counsel to assess their current compliance posture and ensure they are prepared to meet evolving federal cybersecurity requirements.

Utilities experiencing similar OT outages should immediately contact legal counsel to evaluate their options and reporting obligations, including assessing whether to file a complaint with the FBI’s Internet Crime Complaint Center (“IC3”) or CISA’s Operations Center. 

Practical Takeaways

The central takeaway is that water and wastewater utilities should treat internet-facing PLCs and undocumented remote-access pathways as urgent risk-reduction priorities. The most important immediate measures are to disconnect PLCs from direct internet exposure, route remote access through controlled gateways or VPNs, change default credentials, use strong unique passwords, apply firewall or ACL restrictions, verify clean PLC backups, and review modem, HMI, workstation, and PLC logs for signs of compromise. Longer term, utilities should implement structured cybersecurity risk-management programs using CISA/EPA resources and assessment tools.

Our team will continue to monitor the ongoing cyberattacks on water infrastructure and will provide updates as federal agencies issue additional guidance or as the regulatory landscape evolves.