Recent suspected cyberattacks by Iran-linked hackers on U.S. water systems follow years of warnings and stalled efforts to improve cybersecurity. In 2023, the EPA proposed stronger guidelines, but faced legal challenges from Republican-led states and industry groups, leading to the order's rescission. Despite these setbacks, at least a dozen states have reported incidents to the FBI, with at least 100 municipalities detecting malicious hacking efforts. Attacks have caused disruptions, including boil-water advisories, though no drinking water has been rendered unsafe.

These incidents highlight vulnerabilities in the nation's approximately 150,000 public water systems, many of which are small and lack adequate cybersecurity measures. Federal agencies, including the Cybersecurity and Infrastructure Security Agency, have issued alerts warning of Iranian-affiliated hackers targeting critical infrastructure. Experts like Tatyana Bolton emphasize the consequences of neglecting cybersecurity investments, noting that past attacks, such as one on a New York dam over a decade ago, could have been far more catastrophic.

The current wave of attacks, which intensified after a federal alert, is believed to be orchestrated by Iran's Islamic Revolutionary Guards Corps. While the assessment is preliminary, officials warn of potential escalations as the conflict with Iran continues. The rudimentary nature of these attacks, targeting easily accessible and insecure internet-connected computers, underscores the urgency for improved defenses and greater funding for state and local governments to bolster digital protections.