Hackers Targeted Municipal Water Systems in 7 States This Week, FBI Says

The quiet threat to America’s critical infrastructure has been lurking in plain sight for years. Nation-state actors and malicious entities have long targeted the nation’s drinking water supplies, exploiting vulnerabilities that put public health at risk.

This week’s revelation that hackers targeted municipal water systems in at least seven states is a stark reminder of the vulnerability of these systems. The FBI and EPA have warned utilities nationwide about the potential threat, but more needs to be done to protect these vital systems from cyberattacks. In Minnesota, malicious activity has already degraded water operations.

President Trump’s attempt to deflect blame onto Minnesota’s leaders only serves to muddy the waters. However, it doesn’t change the fundamental reality: our nation’s critical infrastructure is under siege. The escalating conflict with Iran has created a perfect storm of tensions that makes the US’s water systems an attractive target for malicious actors.

Federal agencies issued a public advisory in July, cautioning companies to boost their defenses against Tehran-linked hackers trying to breach online automated devices used to manage infrastructure systems. This warning comes on the heels of an EPA enforcement alert in May 2024, which highlighted that about 70% of utilities inspected by federal officials had violated standards meant to prevent breaches or other intrusions.

Historically, we’ve seen a pattern of complacency and lack of investment in cybersecurity measures across various industries, including water management. The EPA’s own data shows that the nation’s infrastructure is struggling to keep pace with the rapidly evolving threat landscape.

Control systems used by municipal water utilities are particularly vulnerable due to their internet connectivity. Federal agencies have called for operators to remove programmable logical controllers from direct internet exposure and implement more robust security measures to mitigate the risk.

However, this needs to be more than just a reactive measure; it requires a proactive approach to cybersecurity that engages all stakeholders – federal agencies, utilities, and local governments – in a concerted effort to protect our nation’s water systems. The lack of clear attribution in these incidents underscores the need for enhanced intelligence-sharing and cooperation between agencies.

To address this growing threat, it’s essential that we prioritize the development of more robust cybersecurity measures tailored specifically to the needs of water utilities. This includes investing in advanced threat detection capabilities, enhancing training programs for utility personnel, and fostering a culture of cybersecurity within these organizations.

The stakes are too high to ignore; our nation’s drinking water supplies are under siege, and it’s imperative that we take immediate action to protect them. Anything less would be a dereliction of duty – and a betrayal of the trust placed in us by the American people.