Twelve states are now responding to cyberattacks against water and wastewater utilities, ABC News reported Tuesday, up from the seven-state count the FBI released last week. Hackers targeted systems controlling pumps, water pressure, and valves inside treatment plants. Some incidents produced what the FBI formally described as "loss of pressure and flooding," though drinking water across all affected regions is reported safe.
The mechanism: internet-connected devices that were not supposed to be
The attack surface is direct. Many of the industrial control devices hackers exploited were never designed to connect to the internet. Many were connected anyway, which provided the opening. Once inside, attackers changed passwords and locked plant workers out of the systems used to monitor and control facility operations, the FBI said. Several jurisdictions fell back to manual operations, and CISA noted that some issued precautionary boil-water notices after pressure losses. Minnesota absorbed the sharpest single blow: more than 30 water systems hit in one coordinated campaign.
Attribution dispute
Multiple news outlets have reported that officials suspect Iran is behind the campaign. No formal attribution has been confirmed. President Trump said Friday he does not "think there was an Iranian cyberattack." The FBI's count of seven affected states grew to twelve within a week. The full scope is still being counted.
| Metric | Count | Source |
|---|---|---|
| States affected (reported Tuesday) | 12 | ABC News |
| States in prior FBI tally | 7 | FBI |
| Water systems hit in Minnesota | 30+ | FBI |
| Years volunteer defenders active | 2 | Reported |
Why water utilities are structurally exposed
Most U.S. water utilities are run by local governments, where cybersecurity budgets compete directly against schools and transportation for the same municipal dollars. Lawmakers and national security officials have flagged this gap for years. Unlike electric utilities and many other critical infrastructure sectors, water systems operate under no comparable federal cybersecurity baseline. That gap has been visible long enough that a group of volunteer hackers has spent the last two years working alongside local utilities to improve their defenses. If the 12-state figure holds, this campaign ranks, by published accounts, as one of the broadest coordinated attacks on U.S. municipal water infrastructure on record.