Hackers linked to foreign adversaries targeted municipal water systems in at least seven U.S. states over the course of a single week, the FBI disclosed, raising fresh alarms about the vulnerability of critical infrastructure that serves millions of Americans.
The coordinated campaign struck small and mid-sized water utilities, many of which lack dedicated cybersecurity staff or budgets. Federal officials described the intrusions as part of a broader pattern of state-linked cyber operations probing American infrastructure for weaknesses that could be exploited during a future conflict.
The bureau confirmed that hackers targeted water systems in seven states, though officials did not publicly identify every affected utility. NBC News reported that the FBI issued warnings to water authorities about the scope of the threat and urged immediate defensive measures.
Several of the targeted systems relied on outdated software and default passwords on internet-facing devices, conditions the FBI flagged as common entry points. In at least some cases, the attackers gained access to operational technology systems, the digital controls that manage water treatment and distribution, rather than merely breaching administrative networks.
That distinction matters. Administrative breaches can expose customer data. Operational technology intrusions can, in theory, alter chemical treatment levels or disrupt water flow to homes and businesses.
Federal officials linked the campaign to hackers associated with hostile foreign governments, including groups tied to Iran and China. The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) had previously warned that Iranian-affiliated hackers compromised water utilities using programmable logic controllers manufactured by the Israeli company Unitronics.
Those controllers are widely deployed in small American water systems. Many were installed with factory-default credentials still active, a basic security lapse that gave attackers a simple path inside.
Chinese state-sponsored hackers, operating under a group U.S. officials have labeled Volt Typhoon, have also been identified as targeting water infrastructure. Intelligence officials have described Volt Typhoon's strategy as "pre-positioning" inside American networks, embedding access that could be activated during a geopolitical crisis such as a conflict over Taiwan.
The pattern exposes a structural problem in American water security. The United States has roughly 150,000 public water systems. The vast majority serve small communities and operate on tight budgets. Many lack a single full-time IT employee, let alone a cybersecurity team.
Federal officials have acknowledged that these systems represent soft targets. CISA has offered free vulnerability scanning and technical assistance, but participation is voluntary. No federal mandate requires small water utilities to meet specific cybersecurity standards, a gap that critics say leaves the door open for exactly the kind of campaign the FBI described.
The Environmental Protection Agency attempted in 2023 to impose cybersecurity audit requirements on public water systems through existing Safe Drinking Water Act authority. A federal court blocked the effort after legal challenges from states and water industry groups, which argued the EPA lacked statutory power to impose such mandates without new legislation from Congress.
That court ruling left a vacuum. Congress has not passed legislation filling it. The result is a patchwork where large metropolitan water authorities often maintain strong cyber defenses while smaller systems remain exposed.
FBI and CISA officials have urged water utilities to take immediate steps: change all default passwords, disconnect unnecessary devices from the internet, enable multi-factor authentication, and monitor systems for unusual activity. Those recommendations, however, carry no enforcement mechanism.
Industry groups have pushed back against unfunded mandates, arguing that small utilities cannot absorb compliance costs without federal financial support. The tension between security urgency and fiscal reality has stalled legislative progress.
Authorities have not publicly confirmed whether any of the targeted systems suffered operational disruptions or whether water quality was compromised at any point during the intrusions. Investigators have not said whether the hackers exfiltrated data, planted persistent backdoors, or attempted to manipulate treatment processes.
The FBI has not disclosed the full list of affected states or utilities. Officials have also not detailed the precise timeline of each intrusion beyond confirming the attacks occurred within a compressed one-week window.
Investigators will need to determine how many systems the attackers actually penetrated versus merely probed, and whether any access points remain active. The distinction between reconnaissance and operational compromise carries significant implications for public safety assessments.
The FBI's disclosure fits a pattern of escalating public warnings from federal law enforcement and intelligence agencies about infrastructure targeting. In early 2024, FBI Director Christopher Wray told Congress that Chinese hackers had embedded themselves inside American critical infrastructure at a scale "unprecedented" in scope.
Water systems sit alongside power grids, telecommunications networks, and transportation hubs on the list of sectors federal officials consider most vulnerable. Unlike power companies, which face mandatory cybersecurity standards enforced by the Federal Energy Regulatory Commission, water utilities operate under no comparable federal regime.
That disparity has drawn bipartisan concern on Capitol Hill, though no legislation has reached the president's desk. Several proposals have circulated that would create grant programs to fund cybersecurity upgrades for small water systems, but none have advanced through both chambers.
For the towns and cities served by the targeted utilities, the episode is a reminder that cyber threats are not abstract. Clean drinking water ranks among the most basic services local government provides. A successful attack that altered chemical dosing or shut down distribution pumps could create a public health emergency with little warning.
Federal officials have stressed that no such emergency materialized from this particular campaign. But the fact that attackers reached operational technology layers in some systems suggests the margin was thinner than the public might assume.
The FBI has asked any water utility that suspects unauthorized access to contact its local field office or report through CISA's online portal. The bureau emphasized that early reporting improves the chances of identifying attackers and closing vulnerabilities before they are exploited again.
Foreign hackers probing the water Americans drink is not a theoretical risk anymore. The only open question is whether Washington will close the regulatory gap before an intrusion crosses the line from reconnaissance to real damage.
