Hackers Are Coming for Your Tap Water

A flurry of recent cyberattacks shows a new battleground for which local authorities are ill-prepared.




RAQUEL NATALICCHIO|HOUSTON CHRONICLE|GETTY IMAGES
A water tower is seen through a canopy of trees in Sugar Land, Texas.

By Olivier Knox
|
Aug. 11, 2026, at 4:00 p.m.

Our water is under attack.

Last week, the Clayton County Water Authority in Georgia announced it was investigating a cyberattack that disrupted its operations “as utilities nationwide are facing a growing number of cyber threats targeting critical infrastructure.”

The intrusion led to reduced water pressure in some areas, prompting CCWA to issue a boil-water advisory. Service was restored “within hours,” and the boil advisory was lifted after testing showed the water was safe to drink, it said.

Welcome to a relatively new national security cyber battleground. You’ve seen cyberattacks on businesses and the federal government before. But now it looks like malicious actors have turned their attention to the life-sustaining substance that comes out of your tap.

A Federal Warning

The CCWA announcement came just days after the FBI and Environmental Protection Agency issued a joint warning that unnamed “malicious cyber actors” had targeted water and wastewater utilities in seven states. The number has since risen to 12, according to CBS. The New York Times reported more than 100 municipalities had been targeted.

“After remotely accessing internet-facing devices, the actors changed the (affected utilities’) IP addresses and passwords, resulting in a loss of monitoring and control functionality,” the agencies said.

Among the changes the FBI and EPA recommended: disconnecting key devices from the internet and adopting passwords “that are not easily guessable.”

Suspicion quickly settled on Iran, which has been in a war with the United States and Israel since late February and has been the main suspect behind other attacks on American infrastructure. Contradicting federal officials, President Donald Trump dismissed the notion of Iran’s involvement, while blaming the attacks in Minnesota on supposed government incompetence in the state led by Gov. Tim Walz, a Democrat with whom he has a long-running public feud.

But the real problem, at least from a U.S. policy perspective, is that Washington is trying to protect creaky vital infrastructure that is typically under local, not federal, control – and overseen by authorities who often lack the funding, staff or systems to defend it.

Waterworks

Unlike other potential targets like financial networks, the water grid is heavily fragmented. America is home to nearly 150,000 publicly owned water systems that provide drinking water, about a third of which are community water systems. According to EPA data cited by the University of Michigan, the overwhelming majority serve fewer than 3,300 residents.

And that sets up the classic policy conundra of federalist America. Washington doesn’t always have the authority to impose a solution. And if it does, there’s no promise it’ll provide the money to execute. Local authorities don’t have Washington’s budgets, and they’ll always bristle at unfunded mandates.

Back in 2023, the EPA attempted to require cybersecurity audits as part of sanitary surveys, but the mandate was frozen by federal courts and ultimately rescinded by the EPA in the face of lawsuits from state attorneys general and the water industry, who contended the agency had exceeded its authority.
The EPA and the Cybersecurity and Infrastructure Security Agency can issue technical advisories and best practices (like the password advice, above). But they can only compel a limited set of actions and only by some utilities.

In a May 2024 enforcement notice, the EPA noted that 70% of inspected water systems failed basic security requirements. But the EPA cannot make a municipal water board in rural America hire a full-time IT director or change its password from “PASSWORD1234.”

That’s all against the backdrop of clear incentives America’s enemies have to keep probing our vital infrastructure. Even if all they do is force a brief “boil water” order for 300,000 residents and businesses in the Atlanta metro area, the psychological impact can be pretty high. Now imagine a sustained attack that disrupts flows to hospitals or severely damages water infrastructure.
And U.S. water supply vulnerabilities only stand to increase. The EPA warned in a 2023 assessment of drinking water infrastructure that American systems need $625 billion in spending over the next two decades to maintain the country’s clean drinking water supply.

It may end up being a lot more than that: The word “cyberattack” does not appear in the report.

Source