The FBI and EPA warned that cyberattacks have hit water facilities in seven states across the US, with seven utility companies compromised since July 27, 2026. Victims reported flooding and loss of water pressure, as hackers infiltrate systems via Programmable Logic Controllers (PLCs) and alter IP addresses and passwords.

The attackers gain remote access to internet‑facing devices, disabling utilities’ ability to monitor and control operations. Authorities advise using secure gateways, firewalls, stronger passwords, and access control lists to limit exposure. The FBI noted that pressure loss can allow untreated groundwater to seep into pipes, amplifying damage beyond simple low pressure.

The warning follows more than 30 municipal water facilities in Minnesota being infiltrated, with NBC News and Wired linking the campaign to Iranian actors. A memo from the Water Information Sharing and Analysis Center (Water ISAC) ties the Minnesota attacks to a broader hacking effort previously flagged by CISA as “Iran‑affiliated.” Law enforcement continues to investigate.

CISA issued its own alert in April that Iran‑affiliated hackers target water infrastructure, urging utilities to bolster defenses. The coordinated response highlights the growing threat to critical U.S. water systems and the need for robust cybersecurity measures.