Water systems are under direct assault, and the warning from the US civilian cyber defence agency is more than a bulletin — it is a red siren. On July 30, officials called out a sharp rise in attacks against the very technology that monitors, controls and keeps taps flowing. Operators were told to remove systems from the internet immediately. That instruction is blunt for a reason: exposure equals opportunity for attackers, and the consequences are not theoretical.
What happened and why it matters
Two days earlier, Minnesota’s state IT agency disclosed a coordinated cyberattack that targeted more than 30 community water systems over July 26 and 27. The FBI has since received reports of incidents across at least seven states, and some attacks degraded water operations. In several cases, operators were locked out when passwords were changed, devices were disconnected, and manual resets were required. Boil-water notices and sustained manual operations followed. In some places, reported operational effects included loss of pressure and even flooding.
These events did not spring from a vacuum. Advisories and previous incidents show a pattern: remote monitoring and control equipment, especially programmable logic controllers (PLCs) and human-machine interfaces (HMIs), are being targeted. The latest public analysis points toward activity consistent with Iran-linked groups, though attribution remains under investigation. The geopolitical backdrop — increasing kinetic attacks and reciprocal threats — raises the stakes. When infrastructure becomes a theatre for geopolitical signalling, the margin for error shrinks sharply.
A reality check from the control room
There was a night when a regional operations room flickered with urgency. Technicians worked under fluorescent lights, phones glued to ears, while paper checklists — the analogue lifeline — were passed hand to hand. Confidence eroded as digital dashboards went dark and pumps had to be started manually. That scene is not cinematic hyperbole: it is the lived reality many communities face when automated systems fail. Frustration, fear and a fierce determination to keep water flowing — emotions ran high. Remember this: the human cost is immediate and local, even when headlines talk about nation-states.
Practical steps to harden systems now
Complacency is contagious but preventable. The following actions are urgent and non-negotiable for water and wastewater operators and their IT partners:
- Disconnect internet-facing control devices immediately. If a PLC, HMI or router is reachable from the public internet, take it offline until vetted remote access is implemented.
- Inventory and map assets. Know every device, every vendor, every remote-access method. Blind spots are where attackers lurk.
- Segment networks. Separate operational technology (OT) from corporate networks. Strictly control traffic between zones with firewalls and access control lists.
- Enforce strong credentials and multi-factor authentication. Unique, complex passwords combined with MFA make opportunistic takeover far harder.
- Harden and patch devices. Apply vendor security updates for PLCs and HMIs where available. Disable unused services and ports.
- Monitor for anomalies. Deploy logging, intrusion detection, and behaviour analytics tuned for OT protocols. Detect deviations early.
- Prepare and rehearse manual procedures. Manual control must be tested regularly. Paper plans should not be an afterthought.
- Back up configurations offline. Keep verified, immutable backups of PLC and HMI configurations off the network.
- Report incidents to federal and state partners. Timely reporting unlocks threat intelligence and coordinated response resources.
Culture, coordination and continuity
Technology alone will not fix this. Leadership must treat resilience like a utility-level priority. Tabletop exercises should be mandatory, not optional; staff must practice responding to full-scale outages and tampering scenarios until muscle memory takes over. Vendors and integrators must be held to security standards. Contracts should include minimum-hardening clauses and timely patch commitments.
Coordination matters. State agencies, the FBI, CISA and local operators need clear lines of communication. When incidents occur, rapid information sharing prevents duplication of effort and speeds containment. Communities deserve transparent updates about water safety; technical jargon does not substitute for clear, authoritative communications to the public.
Final word — urgency with purpose
Threats against water infrastructure are not hypothetical. They are happening now. Remove exposed systems from the internet. Confirm that backup controls and manual operations are fully functional. Map assets. Patch devices. Train staff. Report incidents. Each measure reduces the attack surface and buys time when it matters most.
Composure and urgency must coexist. Calm, methodical action under pressure will keep taps running and communities safe. The warning from federal agencies is a call to action; respond decisively, not later.