Make money doing the work you believe in
Our Water Infrastructure is Vulnerable & the Industry's Own Report Says We're Not Ready
While we've been tracking how data centers are straining our water supplies, a different kind of threat just hit the same fragile infrastructure: hackers.
Here’s what we know:
On July 30, the FBI and EPA issued a joint warning that malicious actors have been breaking into water and wastewater systems in at least seven states since late July, targeting internet-connected industrial controllers, which are the devices that manage pressure, flow, and treatment.
Attackers changed IP addresses and passwords, locking operators out of their own systems. The result, in some cases included pressure loss and flooding, the kind of failure that can let untreated water seep into pipes meant to carry clean water to your tap.
So far, incidents matching the federal warning have surfaced in Minnesota (more than 30 systems), Michigan, South Dakota, and California. Investigators are still working out whether Iran is behind it, or whether someone is mimicking Iranian tactics to muddy the waters.
It’s worth noting that just last month the American Water Works Association (AWWA), which provides key insights into the priorities for water utilities and challenges they currently face, released its 2026 State of the Water Industry report.
It flagged cybersecurity as a top-10 industry concern, moving up the list from the year before. Utilities know the risk is real. More than 60 percent say cybersecurity is a top priority for innovation, and most report their programs are fully funded or will be within three years.
But knowing and being ready aren't the same thing.
Dig into the report's fine print and you’ll see the gap. Among small water systems, 22 percent say they have little to no ability to actually implement cybersecurity practices.
These are often the same systems running decades-old hardware with no IT staff, no budget line for a firewall upgrade, and now, no shield against actors probing the open internet for exactly this kind of vulnerability.
It's the same story running through so much of our water coverage.
We’re looking at an industry stretched thin by aging pipes, tightening budgets, and rising costs now also expected to defend itself against nation-state-level cyber threats with a five-year outlook.
"Utilities clearly recognize the importance of investing in technology and cybersecurity, but many still face real challenges in execution," Nicholas Santillo Jr., former chair of the Water Sector Coordinating Council, said in the report.
The question isn’t whether our water systems are vulnerable. It's how many more warnings we need before we fund the fix.
