Recent cyberattacks have exposed significant vulnerabilities in critical infrastructure, with over 30 water systems in Minnesota experiencing coordinated attacks that began on July 26. Within a week and a half, these incidents escalated, affecting at least a dozen states and resulting in service disruptions, boil-water advisories, reduced pressure, and flooding.
On July 30, a joint statement from the Federal Bureau of Investigation (FBI) and the Environmental Protection Agency (EPA) detailed how malicious actors gained control of internet-connected devices by altering IP addresses and passwords. Reports indicate that Iranian hackers are likely behind these attacks, as confirmed by multiple news sources.
Fortunately, most facilities managed to restore their services within hours by switching to manual operations. However, experts warn that these attacks underscore alarming weaknesses in the cybersecurity of essential infrastructure. “We’re in a lot worse shape than you would think,” states Maurice E. Dawson, a cybersecurity professor at the Illinois Institute of Technology.
The nature of these attacks should not have been unexpected. As early as 2023, the Cybersecurity and Infrastructure Security Agency (CISA) issued alerts warning about threats to water systems due to vulnerabilities linked to default passwords on internet-connected devices. In April 2026, CISA reiterated its warnings regarding Iranian-affiliated actors targeting U.S. water and energy systems, updating operators on specific devices at risk just days before the attacks commenced in Minnesota.
Understanding the Vulnerabilities
The recent cyber incidents targeted industrial computers known as programmable logic controllers (PLCs), which are crucial for managing complex industrial control systems. According to Process Solutions, these PLCs are prevalent across various industries, including food processing and water treatment, and many have not received security updates for decades, rendering them susceptible to attacks.
Michael Garcia, policy director of the Operational Technology Cybersecurity Coalition, noted that once these PLCs were discovered online, their passwords were often weak or easily guessed. “It was very much low-hanging fruit for an actor to go and attack these systems,” he remarked. A recent analysis by the firm Censys identified 4,148 PLCs exposed on the internet, with a staggering 71% located in the United States. Garcia explained how attackers could use tools like Shodan to find public IP addresses of water facilities and exploit known default login credentials.
Once the vulnerabilities were identified, accessing these PLCs became straightforward for attackers, leading to the advice from CISA for operators to disconnect PLCs from the internet immediately and revert to manual operations.
Challenges in Infrastructure Security
In the United States, there are approximately 156,000 public water systems, with 97% serving populations of 10,000 or fewer. These systems often operate on tight budgets with limited IT resources, which complicates efforts to enhance cybersecurity. “These are older operating systems that aren’t getting regular updates,” Dawson noted. “They may be secure initially, but as time passes, they become increasingly vulnerable and costly to fix.”
While some progress has been made, with Congress allocating $1 billion over four years for the State and Local Cybersecurity Grant Program, there are ongoing delays in reauthorization efforts, leaving many local utilities without the funds necessary for critical updates. “It comes down to cost,” Garcia explained, noting that while there are proposals for reauthorization, they are currently stalled in Congress.
Safety Recommendations for Residents
Despite the relatively limited impact of these attacks, most residents did not experience water shortages. However, experts recommend that individuals take proactive measures to prepare for potential future incidents. These include:
- Stock up on water: The Federal Emergency Management Agency (FEMA) advises storing at least 1 gallon of water per person per day for several days and suggests keeping commercially bottled water in a cool, dark place.
- Follow utility providers on social media: Local governments and utility companies often use social media to share updates during cyber incidents, including boil-water notices.
- Make a plan for water treatment: In the event of a boil-water notice, FEMA recommends boiling water for at least one minute to ensure safety.
Conclusion
The recent wave of cyberattacks affecting water systems across multiple states highlights ongoing vulnerabilities in critical infrastructure. Although this is not a new issue, the scale and nature of these incidents raise concerns about the potential for more severe consequences in the future. As Michael Garcia pointed out, “We’ve just been extremely fortunate that there hasn’t been a mass casualty event. But there is that potential.”
