Cyber Attacks on U.S. Water Systems Highlight Ongoing Vulnerabilities

WHO:

The New York Times - Environmental Protection Agency (E.P.A.), Biden administration, Republican-led states, industry groups, hackers tied to Iran’s Islamic Revolutionary Guards Corps, Clayton County Water Authority, Columbus Water Works, FBI, Clayton County resident Patricia Mahone, Gov. Brian Kemp.

WHAT:

ABC News - Two municipal water systems in New Jersey were targeted in cyberattacks in the last week, widely thought to be the work of Iran.

CBS News - The FBI, E.P.A., and Cybersecurity and Infrastructure Security Agency warned that cyber threat actors had remotely accessed online infrastructure for water and wastewater systems in at least seven states, resulting in a loss of monitoring and control functionality.

WSB-TV - The FBI issued a nationwide alert warning that malicious cyber actors are targeting operational technology devices used by water and wastewater utilities.

CBS News - Cyberattacks on U.S. water systems that officials suspect may be linked to Iran-backed hackers have been reported in at least a dozen states.

CBS News - In Georgia, the Clayton County Water Authority experienced a water pressure drop last month due to cyber activity, leading to a boil water advisory, which was lifted within hours.

CBS News - Some utilities have lost critical remote-control capabilities, forcing operators to switch to manual mode.

CBS News - Cyberattacks on U.S. water systems have been reported in at least 12 states, including Michigan, Minnesota, Georgia, New Jersey, and South Dakota.

CBS News - In Minnesota, more than 30 community water systems were impacted by the cyberattacks.

CBS News - The Clayton County Water Authority serves 300,000 customers in the Atlanta area and experienced a water pressure drop due to cyber activity last month, leading to a boil water advisory.

CBS News - The tactics used in the attacks resemble a 2023 campaign by the CyberAv3ngers, a group linked to the Iranian Revolutionary Guard, which accessed water-system controllers using default passwords.

ABC News - Two municipal water systems in New Jersey were targeted in cyberattacks in the last week, widely thought to be the work of Iran.

The New York Times - In 2023, the E.P.A. proposed stronger cybersecurity guidelines for the nation’s water supply.

The New York Times - The E.P.A. rescinded the order after lawsuits from Republican-led states and industry groups.

WSB-TV - Two confirmed cyberattacks occurred in Georgia, targeting Clayton County Water Authority and Columbus Water Works.

WSB-TV - The FBI issued a nationwide alert warning of cyberattacks on operational technology devices used by water utilities.

WSB-TV - Utilities in at least seven states reported incidents, with reports indicating the number has grown to 12 states.

WSB-TV - The cyberattack affected programmable logic controllers (PLCs) at Clayton County Water Authority.

WSB-TV - Officials confirmed that the attacks did not compromise water quality or public health.

WHERE:

CBS News - The states affected by the cyberattacks include Michigan, Minnesota, Georgia, New Jersey, and South Dakota.

ABC News - The targeted municipal water systems are located in New Jersey.

The New York Times - The attacks affected water systems in the United States, specifically mentioning a small town in western Pennsylvania and Georgia.

WSB-TV - Clayton County and Columbus in Georgia are the locations of the confirmed cyberattacks.

WHEN:

The New York Times - The E.P.A. proposed cybersecurity guidelines in 2023.

WSB-TV - The cyberattack on Clayton County Water Authority occurred last week, and Columbus Water Works confirmed its attack on Tuesday.

WHY:

The New York Times - The E.P.A. aimed to create stronger cybersecurity guidelines due to vulnerabilities in water systems.

WSB-TV - The FBI's alert was issued in response to malicious cyber actors targeting water and wastewater utilities.

HOW:

ABC News - The cyberattacks on the New Jersey water systems are widely believed to be linked to Iranian hackers.

WSB-TV - Hackers targeted operational technology devices, specifically programmable logic controllers (PLCs) used in water treatment and distribution.

(UPDATED August 6, 2026 11:21 UTC)

Two municipal water systems in New Jersey were recently targeted in cyberattacks, believed to be the work of Iranian cyber actors. The FBI, E.P.A., and Cybersecurity and Infrastructure Security Agency have warned that these malicious actors have remotely accessed online infrastructure for water and wastewater systems in at least seven states, including Michigan, Minnesota, Georgia, New Jersey, and South Dakota. The tactics used in these attacks resemble a campaign from 2023 by the CyberAv3ngers, a group linked to the Iranian Revolutionary Guard, which exploited default passwords to gain access to water-system controllers.

(UPDATED August 6, 2026 01:15 UTC)

Cyberattacks on U.S. water systems, suspected to be linked to Iran-backed hackers, have been reported in at least a dozen states, prompting warnings from the FBI, E.P.A., and Cybersecurity and Infrastructure Security Agency. In Georgia, the Clayton County Water Authority faced a water pressure drop last month due to these cyber activities, leading to a brief boil water advisory. Some utilities have lost critical remote-control capabilities, forcing operators to revert to manual mode, and the tactics used in these attacks resemble a 2023 campaign by the CyberAv3ngers, a group associated with the Iranian Revolutionary Guard.

(UPDATED August 5, 2026 23:53 UTC)

Cyberattacks on U.S. water systems have been reported in at least 12 states, including Michigan, Minnesota, Georgia, New Jersey, and South Dakota, with more than 30 community water systems in Minnesota affected. The FBI, E.P.A., and Cybersecurity and Infrastructure Security Agency have warned that cyber threat actors gained remote access to the infrastructure of water and wastewater systems in at least seven states, compromising monitoring and control functionality. Notably, the tactics used in these attacks are similar to a 2023 campaign by the CyberAv3ngers, a group linked to the Iranian Revolutionary Guard, which exploited default passwords to access water-system controllers.

(UPDATED August 5, 2026 20:33 UTC)

Two municipal water systems in New Jersey were targeted in cyberattacks last week, and these attacks are widely thought to be the work of Iranian hackers. The incidents have raised concerns about the security of critical infrastructure in the region. Authorities are investigating the situation to determine the extent of the breaches and to enhance protective measures.

(UPDATED August 5, 2026 18:33 UTC)

The Environmental Protection Agency proposed stronger cybersecurity guidelines for the nation’s water supply, but rescinded the order after facing lawsuits from Republican-led states and industry groups. Recently, two confirmed cyberattacks targeted water systems in Georgia, specifically the Clayton County Water Authority and Columbus Water Works, prompting the FBI to issue a nationwide alert about threats to operational technology devices used by water utilities. Fortunately, officials have confirmed that these attacks did not compromise water quality or public health, even as reports of incidents have spread to at least twelve states.