Cyberattacks Hit Water Systems in 12 States, Iran Suspected

Water and wastewater utilities across at least a dozen states have reported possible cyber intrusions in what appears to be a coordinated campaign targeting critical infrastructure, according to multiple sources who spoke with ABC News.

Iran is considered the prime suspect behind the attacks, though officials have not formally attributed the incidents. The intrusions have focused on operational technology systems, with attackers changing passwords and disabling alarm systems that utility operators rely on to monitor water treatment processes.

No service disruptions reported

Despite the scope of the campaign, sources told ABC News that no widespread disruptions to water supplies or wastewater treatment have occurred. Local operators have been able to address issues as they arise, maintaining safe operations throughout the affected facilities.

Michigan State Police, representing one of the impacted states, confirmed they are monitoring the situation in coordination with federal partners and the state's Department of Environment, Great Lakes, and Energy. "All systems continued to operate safely, issues were addressed by local operators, and there are no known impacts that posed a public health concern," the agency stated.

FBI issues guidance to utilities

The FBI has issued urgent recommendations to water utilities nationwide in response to the incidents. The bureau is advising facilities to disconnect systems from the internet wherever operationally feasible, implement systems with circuit breakers, and ensure staff are trained on manual control procedures in case automated systems become compromised.

Michigan authorities have been working to communicate with municipal water systems statewide, encouraging facilities using the affected software to secure their systems and follow applicable cybersecurity guidance. The FBI is leading the federal investigation into the incidents.

Why it matters

Water infrastructure represents one of the most critical and vulnerable sectors in the nation's industrial base. Unlike IT breaches that compromise data, attacks on operational technology can directly impact physical processes that millions of Americans depend on daily. The campaign demonstrates how adversaries are increasingly targeting industrial control systems that were never designed with internet connectivity or cybersecurity in mind. For utilities still operating legacy systems with internet exposure, the incidents underscore the urgent need to segment networks and prepare for manual operations.

The details of these cyber intrusions were first reported by ABC News, which spoke with multiple sources familiar with the ongoing investigation.