The FBI says hackers have already reached municipal water controls in at least seven states. Every mayor should now answer a direct question: Is your city's water system still exposed to the public internet?
Since July 27, attackers have targeted programmable logic controllers (PLCs) that run pumps, valves, and other equipment. They changed passwords and internet addresses, leaving operators unable to monitor or control parts of their systems.
MCAs are targeting internet-exposed PLCs (Rockwell Automation/Allen-Bradley’s MicroLogix 1100 and 1400 series) to remotely tamper with device configurations by changing IP addresses and turning on and setting passwords, resulting in a loss of view, and in some cases function, of connected equipment in targeted facilities. At least one organization reported modified PLC project files after noticing ladder logic discrepancies across several sites. Additionally, across several victims, similarities in network setup provided by third parties may provide MCA the opportunity to multiply successes when vulnerable network and hardware setups exist across customers.
Operational effects reported to the FBI have included loss of pressure and flooding. Pressure loss in water systems could potentially allow untreated ground water to seep into pipes. Once compromised, the extent of impact to victims’ operations depended upon the type of function for which the PLC was configured (monitoring versus controlling equipment), the equipment itself (1100 versus 1400), the function the device supported, and capability to switch to manual operations. The FBI and EPA are engaging with victim organizations and are providing the following recommendations for critical infrastructure asset owners and operators.
The effects included lost water pressure and flooding. Pressure loss can also allow untreated groundwater to enter pipes.
The FBI hasn't publicly named the attackers. Attribution may take time, but the weakness requires no guesswork. The targeted controllers were reachable online, and similar network designs installed by third parties may have given hackers a path into several utilities.
A criminal group or hostile government can search for exposed equipment and reuse the same methods from town to town.
The threat is realistic because the attacks have already disrupted operations. Hackers don't need to poison a reservoir to create danger; they can stop pumps, lock out workers, cause flooding, trigger boil-water notices, or force a plant to operate manually.
From the Government Accountability Office:
A cyberattack on U.S. drinking and wastewater systems could, for example, produce drinking water with unsafe levels of bacteria or chemicals. Nations, cybercriminals, and others have targeted some of the nearly 170,000 U.S. water systems, which are increasingly automated.
EPA leads water cybersecurity efforts. It has worked with the water sector to improve cybersecurity. However, EPA hasn't identified and prioritized the greatest risks sector-wide. It also relies on water systems to voluntarily agree to improve cybersecurity.
We recommended that EPA develop a national cybersecurity strategy, assess whether it needs more authority, and more.
Cyberattacks on Water and Wastewater Systems Can Have Consequences for Public Health and the Environment
Federal agencies and other entities have acted to improve water sector cybersecurity, but reported challenges such as workforce skills gaps and older technologies that are difficult to update with cybersecurity protections. Further, the sector has made limited investments in cybersecurity protections because water systems prioritize funding to meet regulatory requirements for clean and safe water, while improving cybersecurity is voluntary. In a May 2024 alert, the Environmental Protection Agency (EPA) said it planned to increase enforcement activities to ensure drinking water systems address cybersecurity threats.
EPA has assessed aspects of cybersecurity risk but has not conducted a comprehensive sector-wide risk assessment or developed and used a risk-informed strategy to guide its actions. EPA is required by law, as well as National Security Memorandum 22 (NSM-22), to identify, assess, and prioritize water sector risk. EPA official said they have assessed threats, vulnerabilities, and consequences, but have not integrated this work in a comprehensive assessment. Without a risk assessment and strategy to guide its efforts, EPA has limited assurance its efforts address the highest risks.
EPA has faced challenges using its existing legal authority and voluntary approaches to manage cybersecurity risks but has not fully evaluated either approach. In March 2023, EPA interpreted existing legal requirements to include cybersecurity assessments at drinking water systems but withdrew the requirement 7 months later after facing legal challenges. Previous requirements and NSM-22 direct EPA to identify the authorities it needs to compel the sector to address risks. In July 2024, EPA officials said they had evaluated their authorities and would release the evaluation in 2025 with their risk assessment and strategy. Doing so and seeking additional authority as necessary can help EPA ensure the water sector is better prepared for any future cyberattacks.
A more skilled attacker could alter controls that manage treatment chemicals or conceal changes long enough to make recovery harder.
Federal inspectors have warned about weak municipal defenses for years. More than 70% of the water systems inspected since September 2023 violated basic federal risk and emergency planning requirements. Inspectors found default passwords, shared staff logins, and accounts that remained active after employees left.
Municipal leaders can't claim they lack a checklist; federal guidance tells utilities to remove control devices from direct internet exposure, use strong and unique passwords, restrict access through firewalls, keep verified backups, review system logs, and practice operating equipment manually. Older devices that no longer receive security updates should be replaced or isolated.
Some work is happening; the EPA identified weaknesses at 277 water systems in 2025 and helped fix 350 vulnerabilities.
Over 70% of the systems inspected by EPA since September 2023 are in violation of basic SDWA Section 1433 requirements including missing specific sections of the RRA and ERP. When on site, EPA inspectors have identified alarming cybersecurity vulnerabilities at drinking water systems across the country and taken actions to address them. For example, some water systems failed to change default passwords, use single logins for all staff, or failed to curtail access by former employees. EPA also has found instances of inadequate RRAs and/or ERPs because analysts did not, for example, include an assessment of the resilience of systems or strategies and resources to improve the resilience of the cybersecurity of those system. These failures involve potential violations of Section 1433 and miss an opportunity to safeguard operations through the RRAs and ERPs.
As part of EPA’s multi-year drinking water National Enforcement and Compliance Initiative, Increasing Compliance with Drinking Water Standards, inspectors are assessing CWS compliance with SDWA Section 1433. Given the vulnerabilities and attacks on systems, EPA also will increase the number of CWS inspections that focus on cybersecurity. Where vulnerabilities are identified and may present an imminent and substantial endangerment to public health, enforcement actions may be appropriate under SDWA Section 1431 to mitigate those risks.
It also offers free, confidential assessments and technical assistance.
From the EPA:
“Access to clean and safe water is foundational to healthy people and environmental protection, thriving businesses, domestic manufacturing, AI, and agricultural production. The threat of cyberattacks is a relatively new and growing concern that water systems must proactively address,” said EPA Assistant Administrator for Water Jess Kramer. “EPA is doing everything within its authority to help water systems tackle cybersecurity threats, including directly eliminating 350 vulnerabilities in 2025. Many cybersecurity solutions are free or low-cost practices that can make a real difference. We are committed to working with our partners in federal, state and local governments to ensure that all water systems are cybersecure.”
Strengthening cybersecurity for water systems is a public health and a national security priority, and EPA is working in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA), states, and water associations to help reduce the risk of cyberattacks. EPA and its partners encourage water systems to implement basic cybersecurity best practices, including reducing exposure of operational technology assets to the public-facing internet, developing and maintaining an asset inventory, and implementing robust authentication protocols including strong passwords and multi-factor authentication. EPA supports water systems with implementing these controls by providing free cybersecurity assessments and technical assistance.
Those numbers show progress, but America has nearly 170,000 drinking and wastewater systems. Many small utilities still struggle with older equipment, thin budgets, and limited cybersecurity staff.
Last week I wrote about attacks against more than 30 Minnesota community water systems and how quickly a local failure can reach household faucets. To our VIP members, I also warned that supply-chain security now depends on trusted data and protected control systems.
Water plants sit inside the same national security problem. Their computers control physical machinery, and corrupted commands can produce physical consequences.
Read More: Iran May Be Testing America’s Water Defenses in Minnesota
Mayors and city councils should demand a current inventory of every internet-connected control device, the date of the last independent assessment, proof that default passwords are gone, and a tested plan for manual operation.
They should also tell residents what has been fixed without publishing details that would help attackers.
Money and staffing are real issues, especially in rural communities. Continued exposure after years of warning is still a choice. The FBI's alert arrived after systems lost pressure and control, not before anyone knew the danger existed.
We're left with a binary choice that every mayor owns now: either the water system has been secured, or the town is waiting for a hacker to discover what local leaders failed to fix.
America’s weak points rarely make headlines until someone exploits them. PJ Media VIP tracks the threats, failures, and decisions shaping the country before the damage becomes unavoidable. Join today and save 60% with promo code FIGHT.
Join the conversation as a VIP Member