Overview
- Federal agencies opened a joint investigation after detecting unauthorized remote access to water and wastewater control systems, and the FBI, EPA and CISA issued a public alert on July 30.
- Attackers gained access to equipment that runs pumps, valves and pressure controls, forcing operators to lose remote control and revert to manual procedures to keep systems running.
- Incidents have been reported in at least 12 states, with Minnesota identifying more than 30 affected community systems and a Clayton County, Georgia disruption that briefly lowered pressure and triggered a boil-water advisory.
- Investigators say the intrusions exploited exposed programmable logic controllers (PLCs), default or weak credentials and direct remote connections, and they see technical similarities to a 2023 campaign under review.
- Agencies say there is no evidence the water supply was contaminated and have urged operators to remove controllers from direct Internet access, change default passwords, strengthen firewalls and keep manual-operation plans while probes continue; the attacks highlight security gaps across thousands of small, distributed utilities.