In brief

A coordinated cyber campaign against US water and wastewater infrastructure has affected at least seven states, expanding beyond the more than 30 Minnesota facilities targeted on July 26–27, 2026. Michigan confirmed malicious activity affecting a small number of communities, while Rapid City, South Dakota, reported an incident involving a wastewater lift station; Georgia was also identified among the affected states, although the remaining three have not been publicly named. Most utilities reported no operational disruption or public-health consequences, and drinking water remained safe. One Minnesota city temporarily shut down its water plant as a precaution.

Iran-linked hackers are considered the leading suspects because the activity reportedly resembles earlier Iranian campaigns against industrial control systems, although the US government has not formally attributed the attacks. Available technical information suggests that internet-accessible equipment using cellular communications may have provided an entry point. Following the incidents, CISA urged water utilities to strengthen protections for operational technology, particularly programmable logic controllers. The risk extends beyond this campaign: approximately 10,000 PLCs made by Rockwell Automation, Siemens and Schneider Electric are reportedly exposed to the internet, underscoring the need to isolate control systems, restrict remote access and secure cellular-connected industrial devices.

Source: SecurityWeek

‍