INFRASTRUCTURE PROTECTIONHow Hackers Attack Municipal Water Systems – and Why the Utilities Are So Vulnerable
There are about 152,000 public drinking water systems in the United States. Many utilities operate with small staffs, so remote connections allow an employee to monitor a distant pump or tank, receive an alarm after hours or let a vendor diagnose equipment without traveling to every site. Remote control reduces site-management cost, but increases vulnerability to hacking.
Hackers tried to break into at least 30 municipal water systems in Minnesota on July 26-27, 2026. Since then, Michigan, New Jersey and several other states have reported similar cyberattacks.
The attackers did not try to infiltrate the computers that utility offices use. Instead, they tried to seize control of small computers in equipment like pumps and valves that deliver drinking water to millions of people.
The utilities countered the attacks by shutting down the control computers and sending personnel out into the field to operate equipment manually. Utility officials have said that water remained safe to drink.
As a scholar who researches cyber conflict, I find that the methods used in these incidents are typical of international cyberattacks. Initial suspicion has fallen on hackers allegedly aligned with Iran, but the U.S. government has yet to attribute the attack to anyone.
How can someone from far away seize control of a water system and possibly shut off the flow or taint the water?
Controlling the Water Machinery
There are about 152,000 public drinking water systems in the United States, according to the federal government. A municipality gets its water from lakes, reservoirs, rivers or underground aquifers.
Pumps move water through pipes to a treatment plant that filters and disinfects it. More pumps push the treated water into storage tanks, then through distribution pipes to homes and businesses. The entire system can span many square miles.
The hackers accessed small computers called programmable logic controllers at the water systems that operate all sorts of industrial equipment. The programmable logic controllers read sensors that measure conditions such as water pressure, water chemistry, tank levels and equipment status, and automatically operate pumps, valves and alarms. A household thermostat is a useful comparison: It reads the temperature and tells the heating or cooling system what to do.
The programmable logic controllers also transmit operational data to a utility’s central computer system. Workers use dashboards to monitor the information and send commands back to the controllers. The two-way communications can travel through wired networks, over radio or cellular links, or through internet connections.
Many utilities operate with small staffs, so remote connections allow an employee to monitor a distant pump or tank, receive an alarm after hours or let a vendor diagnose equipment without traveling to every site.
