Cyberattacks targeting water and wastewater facilities across the United States are raising new concerns about the vulnerability of critical infrastructure and the possibility that Iran-linked hackers are using cyber operations as another front in the conflict.

Recent attacks affected water facilities in several states, including Minnesota, where local communities experienced disruptions at treatment plants. Although the incidents did not result in widespread contamination or prolonged loss of water service, cybersecurity experts warn that the attacks could represent a significant escalation in threats against America’s aging infrastructure.

Minnesota Water Facilities Targeted by Cyberattacks

The warning became real for the small Minnesota community of Braham when operators discovered that a pump at the local water treatment plant had stopped working.

The disruption temporarily forced the facility offline and prompted officials to ask approximately 1,700 residents to conserve water while the city relied on a backup supply.

Workers restored the system within a few hours after manually taking control of the pump.

The incident initially appeared to be a technical failure. But after local officials consulted with Minnesota’s state information technology teams, they learned that other water facilities had experienced similar problems.

Authorities subsequently identified the incidents as part of a broader coordinated cyberattack targeting industrial technology.

A Nationwide Critical Infrastructure Threat

The attacks were not limited to Braham.

Between late July and early August, water and wastewater facilities in multiple states reported operational disruptions. Federal authorities eventually confirmed that at least seven states had experienced similar attacks.

The FBI is investigating the incidents, while cybersecurity organizations have been working with water utilities to share information about the threat.

Experts say the number of affected facilities could ultimately be larger because attackers appeared to target industrial equipment connected to the internet.

Rob Lee, CEO of cybersecurity company Dragos, said the number of simultaneous targets with operational consequences was unusual.

The concern extends beyond water systems. Many critical infrastructure sectors rely on similar industrial technology, meaning the same vulnerabilities could potentially affect energy, transportation and other essential services.

Why Iran Is Suspected

The U.S. government has not officially attributed the latest attacks to Iran.

However, Iranian-linked hackers have previously targeted American critical infrastructure.

In 2023, an Iranian-linked group compromised an industrial control device at a water facility in Aliquippa, Pennsylvania. The attackers manipulated the equipment to display anti-Israel messages.

U.S. cybersecurity officials have also warned about Iranian-linked actors scanning internet-connected industrial control systems for vulnerabilities.

The timing of the latest attacks has increased concerns that the activity could be connected to the ongoing conflict between the United States and Iran.

One cybersecurity expert who spoke anonymously told NPR that intelligence pointed toward a connection with Iran’s Islamic Revolutionary Guard Corps, although that assessment has not been publicly confirmed by the U.S. government.

Water Systems Are Particularly Vulnerable

Water utilities face a unique cybersecurity challenge because many of their systems depend on operational technology, or OT.

Unlike conventional information technology, OT directly controls physical processes such as pumps, valves, pressure systems and chemical treatment.

Much of this equipment is decades old.

Replacing or updating these systems can be expensive and complicated. In some cases, manufacturers must certify software updates, while installing a security patch may require taking an entire treatment facility offline.

That creates a difficult balance between modernization and maintaining continuous water service.

Internet-Connected Industrial Systems Create New Risks

Cybersecurity experts say some of the recent attacks appear to have exploited relatively basic vulnerabilities.

These can include industrial devices exposed directly to the internet, systems using default usernames and passwords, and insufficient separation between operational technology and business networks.

Basic security measures can significantly reduce these risks.

Water operators can change default credentials, restrict internet access to industrial equipment, separate OT networks from business systems, strengthen authentication and deploy appropriate firewalls.

However, experts warn that future attacks could be considerably more sophisticated.

Could Cyberattacks Disrupt More Than Water?

The water sector is only one part of America’s critical infrastructure.

Electricity grids, transportation systems, hospitals, telecommunications networks and data centers also depend heavily on interconnected industrial technology.

Cybersecurity specialists have warned for years that foreign adversaries could attempt to gain access to critical infrastructure before a major geopolitical confrontation.

China-linked groups such as Volt Typhoon, for example, have been accused by U.S. officials of targeting critical infrastructure and maintaining persistent access to systems.

The objective in such scenarios may not necessarily be immediate destruction.

Instead, attackers could attempt to create uncertainty, disrupt essential services and force governments to divide their attention during a broader crisis.

Why Rural Water Systems Face Greater Challenges

Small and rural water utilities may be particularly vulnerable because they often operate with limited budgets and small technical teams.

Some facilities have only a handful of employees responsible for maintaining complex infrastructure.

That makes cybersecurity difficult to prioritize alongside everyday operational challenges.

Brandon Huston of the Minnesota Wastewater Operators Association said some operators deliberately avoid connecting their systems to the internet because maintaining and securing those connections requires resources many small communities do not have.

The problem is particularly serious because water infrastructure cannot simply be replaced overnight.

Federal Officials Push for Greater Cybersecurity Support

The recent attacks have renewed calls for increased federal support for water infrastructure cybersecurity.

Organizations such as the Water Information Sharing and Analysis Center, or WaterISAC, have been working to distribute threat intelligence to water utilities.

The Environmental Protection Agency has also held briefings to help operators understand emerging cyber threats.

Meanwhile, initiatives such as Project Franklin are attempting to bring cybersecurity specialists and volunteers directly to smaller water utilities.

One proposed effort, the Water Watch Center, aims to provide additional support through managed service providers that already work with local utilities.

Researchers are also exploring whether artificial intelligence could eventually help defend operational technology systems in real time.

What Water Utilities Can Do Now

Experts recommend several basic measures that can make water treatment systems more difficult to compromise:

• Change default usernames and passwords on industrial devices.
• Remove unnecessary systems from the public internet.
• Separate operational technology from business networks.
• Use strong authentication and access controls.
• Install properly configured firewalls.
• Monitor internet-facing industrial equipment.
• Share threat intelligence with organizations such as WaterISAC.
• Develop incident-response and manual-operation plans.
• Regularly assess aging industrial equipment for vulnerabilities.

These measures cannot eliminate the threat, but they can reduce the likelihood that relatively simple vulnerabilities will lead to operational disruptions.

A Warning for U.S. Critical Infrastructure

The recent attacks have demonstrated how cyber conflict can reach communities far removed from the battlefield.

For residents, a sophisticated international cyber operation can manifest itself as something remarkably ordinary: a pump that suddenly stops working.

That is precisely what makes critical infrastructure attacks so concerning.

Water, electricity and transportation systems are essential services. Even a temporary disruption can create uncertainty and undermine public confidence.

The attacks on U.S. water facilities may ultimately prove to have been limited and opportunistic. But cybersecurity experts say they should also be treated as a warning.

The United States operates more than 150,000 water and wastewater systems, many of which rely on aging technology and limited cybersecurity resources.

As geopolitical tensions increase, protecting those systems may require more than better passwords and firewalls. It could require a long-term national investment in modern infrastructure, cybersecurity expertise and stronger cooperation between federal agencies, states and local communities.

The central lesson from the recent incidents is clear: water infrastructure is no longer only a public utility issue. It is also a national security issue.