The Cybersecurity and Infrastructure Security Agency (CISA) says it’s aware of 100 internet-exposed water systems targeted in cyberattacks in July.
The information was shared as part of guidance released by CISA to help organizations reduce the internet exposure of systems that could be targeted by threat actors.
“In July 2026, CISA observed malicious cyber activity targeting over 100 internet-exposed systems in the Water and Wastewater Systems (WWS) Sector, commonly via programmable logic controllers (PLCs) connected directly to a cellular modem,” CISA noted.
Hands-On Cyber-Physical Systems Training at ICS Cybersecurity Conference
Until now, federal agencies had not publicly quantified the number of systems affected in the recent wave of attacks on water and wastewater utilities.
The water sector attacks, linked to Iranian threat actors, sought to disrupt operational technology (OT) systems.
The government has not said how many states are affected, but it appears there were at least 12 states. Not all of them are known, but states such as Minnesota, Michigan, South Dakota, Georgia, New Jersey, and Alabama have confirmed that they were targeted.
The cyberattacks did not cause any significant disruption, but they have raised concerns about their potential impact on the water sector.