Hackers have interfered with the systems controlling American drinking-water infrastructure, shutting down equipment, disabling remote monitoring and forcing utility workers to operate facilities manually. Federal authorities have documented attacks on more than 100 internet-exposed industrial systems, while investigators examine possible Iranian involvement.
A cyberattack shut down the municipal well and water-treatment plant in Braham, Minnesota, on 27 July 2026, leaving public works employees racing to restore operations before the town’s stored water ran low.
The electricity was still working. The problem was that the automated controls responsible for operating the equipment were no longer functioning.
Residents were asked to conserve water while workers isolated the affected equipment, restored a backup and restarted the plant. Normal operations resumed approximately 90 minutes later.
The town’s water tower maintained the drinking-water supply throughout the interruption. Officials confirmed that water quality had not been affected.
Braham was one of more than 30 Minnesota communities whose water systems were targeted during a coordinated series of cyber incidents on 26 and 27 July. Similar activity subsequently emerged in Michigan, New Jersey, Georgia and other states.
By August, investigators and cybersecurity researchers had identified incidents across at least 12 states. The US Cybersecurity and Infrastructure Security Agency (CISA) subsequently reported that malicious activity had targeted more than 100 internet-exposed systems in the water and wastewater sector during July.
The figure referred to vulnerable digital systems, not necessarily 100 separate water utilities. It did not mean that every attempted intrusion succeeded or that every affected community lost its water supply.
Nevertheless, the incidents demonstrated that equipment responsible for essential public services could be reached through poorly protected internet connections.
In Plymouth, Minnesota, a cyberattack disrupted communications with two municipal water towers and several wastewater pumping stations.
The affected equipment relied on cellular communications to transmit information about water levels and other operating conditions.
Public works employees switched to manual procedures, physically checking facilities and monitoring equipment while automated communications were unavailable.
The city’s water supply remained safe, and its officials confirmed that water levels and quality had not been affected. Communications were restored the following day.
Michigan reported cyber incidents affecting nine water systems. State authorities said the affected utilities had addressed the problems and that there were no known public-health consequences.
Two municipal water systems in New Jersey also lost automated monitoring capabilities.
The facilities were subsequently identified as the Cape May Water and Sewer Department and the Woodbine Water Department, both in Cape May County.
Operators lost remote communications with parts of their systems and were required to intervene manually.
Local officials said the intrusions had not interfered with drinking-water safety or interrupted supplies. The affected systems were subsequently secured.
Georgia experienced a more consequential disruption.
On 27 July, Clayton County Water Authority, which serves communities south of Atlanta, experienced an interruption affecting operational equipment and water service in parts of northern Clayton County.
Water pressure fell sufficiently for the authority to issue a precautionary boil-water advisory.
The authority subsequently disclosed that it was investigating unauthorised cyber activity that might have caused or contributed to the disruption.
Water service was restored within hours. The advisory was lifted after testing confirmed that the water met applicable safety standards.
The incident did not establish that hackers had contaminated drinking water. It illustrated how an interruption affecting water pressure can create a potential contamination risk requiring immediate public-health precautions.
The Federal Bureau of Investigation identified a common weakness in the equipment targeted during the wider campaign.
On 30 July, the FBI and Environmental Protection Agency warned that hackers were gaining access to internet-connected programmable logic controllers, commonly known as PLCs.
These are specialised industrial computers used to manage machinery. Depending on their installation, they can monitor water levels, regulate pumps, operate valves and control other processes involved in supplying drinking water or removing wastewater.
The FBI identified attacks involving Rockwell Automation and Allen-Bradley MicroLogix 1100 and 1400 controllers.
According to federal investigators, attackers accessed vulnerable equipment remotely and changed network addresses and passwords.
Those changes prevented legitimate operators from monitoring or controlling equipment through their normal systems.
The problem was not necessarily that hackers could immediately contaminate water or destroy machinery. In some cases, the intrusion removed the utility’s ability to observe what its equipment was doing or issue instructions remotely.
Operators then had to rely on local controls, backup arrangements or manual procedures.
Federal investigators also identified cases involving unauthorised changes to controller program files. Such modifications can be more serious because they may alter the instructions governing machinery rather than simply restricting access.
CISA warned that some of the exposed equipment was connected directly to the internet through cellular modems, including devices installed or maintained by outside contractors.
These connections allow operators to monitor distant pumping stations, treatment facilities and storage reservoirs without travelling to each location.
However, poorly secured connections can also provide unauthorised access to industrial equipment.
The agency urged utilities to remove unnecessary internet access, strengthen authentication, examine third-party connections and ensure that essential operations could continue when automated controls became unavailable.
Responsibility for the attacks remains an important unresolved issue.
American officials have investigated possible Iranian involvement, and cybersecurity specialists have identified similarities with previous operations attributed to actors associated with Iran’s Islamic Revolutionary Guard Corps.
An Iranian-linked hacking group known as CyberAv3ngers has claimed responsibility for the wider campaign.
The group has previously been associated with attacks against American infrastructure, including a 2023 intrusion involving a water authority in Aliquippa, Pennsylvania.
In April 2026, the FBI, CISA and other federal agencies issued a joint cybersecurity advisory explicitly identifying Iranian-affiliated actors exploiting internet-connected industrial controllers across several critical infrastructure sectors.
The warning was updated on 22 July, days before the coordinated attacks on Minnesota water systems became public.
That update described additional methods used against industrial equipment, including attempts to manipulate information displayed to operators and interfere with controller programs.
It also identified targeting involving additional industrial equipment manufacturers.
The advisory established that American authorities had documented Iranian-affiliated activity against industrial control systems.
It did not establish that Iranian actors were responsible for every water-system incident reported during the subsequent weeks.
The Center for Strategic and International Studies, which examined the geographical spread of the attacks in August, concluded that the incidents were consistent with a possible Iranian campaign. Its researchers also acknowledged that available reporting was incomplete and that the US government had not publicly attributed the entire operation.
The distinction is significant. Similar methods, overlapping equipment and even public claims of responsibility do not independently establish that every intrusion was carried out by the same organisation.
The broader vulnerability is not new.
American water utilities have faced repeated warnings concerning ageing equipment, limited cybersecurity resources and industrial systems connected to networks they were not originally designed to withstand.
Many smaller utilities operate with limited technical staff and depend on outside contractors for equipment installation, maintenance and remote monitoring.
The July incidents demonstrated how those arrangements can become operational weaknesses when internet-facing equipment is insufficiently protected.
They also showed the value of maintaining independent controls and trained personnel.
In Braham, workers restored the treatment plant before stored water supplies were exhausted. In Plymouth and New Jersey, employees continued operating essential facilities despite losing automated communications. In Georgia, a precautionary public-health response was initiated after water pressure fell.
No widespread contamination of American drinking-water supplies was established as a consequence of the attacks.
The absence of such an outcome should not obscure what investigators confirmed: attackers were able to interfere with systems responsible for operating water infrastructure in multiple American communities.
By August, the federal investigation had expanded from individual municipal incidents to a much wider examination of exposed industrial equipment.
The full number of successfully compromised utilities, the duration of individual intrusions and the extent of attackers’ control over physical operations have not been publicly established.
Neither has the US government issued a definitive public attribution covering the entire July campaign.
The documented incidents nevertheless identify a national infrastructure problem extending beyond any single state or suspected attacker.
Water utilities depend increasingly on remote monitoring and digital controls to maintain services. Those systems can improve efficiency and reliability, but their failure requires immediate alternatives.
The American attacks demonstrated that the difference between a manageable cyber incident and a prolonged interruption to an essential service can depend on whether utility workers retain the means to operate their equipment when the computers controlling it can no longer be trusted.
Sources
Water Plant Issue. City of Braham, Minnesota, 27 July 2026.
https://brahammn.gov/?DE=091B3CB2-4CCA-4EEC-85BF-C62DBE73211A&SEC=85B95912-1C4A-4539-8110-1EFC88EE7C31
MNIT Activates Statewide Cybersecurity Response to Support Affected Communities and Protect Critical Infrastructure. Minnesota IT Services, 28 July 2026.
https://mn.gov/mnit/media/blog/?id=38-761869
Minnesota Continues Response to Cyber Activity Affecting Community Water Systems. Minnesota IT Services, 30 July 2026.
https://mn.gov/mnit/media/blog/?id=38-762209
Communications Restored at Plymouth Water Facilities. City of Plymouth, Minnesota, July 2026.
https://www.plymouthmn.gov/Home/Components/News/News/8977/542
Clayton County Water Authority Security Advisory: Cyber Threat Awareness & Response. Clayton County Water Authority, 3 August 2026.
https://www.ccwa.us/Blog.aspx?IID=35
Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions. Federal Bureau of Investigation, 30 July 2026.
https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet–facing-programmable-logic-controllers-causing-operational-disruptions
CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs. Cybersecurity and Infrastructure Security Agency, 30 July 2026.
https://content.govdelivery.com/accounts/USDHSCISA/bulletins/422e63c
CISA, FBI, EPA and US Government Partners Update Warning of Iran-Affiliated Threat Actors Targeting Critical Infrastructure Programmable Logic Controllers. Cybersecurity and Infrastructure Security Agency, 22 July 2026.
https://content.govdelivery.com/accounts/USDHSCISA/bulletins/4219689
Internet Exposure Reduction Guidance. Cybersecurity and Infrastructure Security Agency, August 2026.
https://www.cisa.gov/resources-tools/resources/exposure-reduction
Mapping Iranian Cyberattacks on U.S. Water Systems. Center for Strategic and International Studies, 18 August 2026.
https://www.csis.org/analysis/mapping-iranian-cyberattacks-us-water-systems
