Cyberattack on US Water Utilities Spreads to 7 States

A wave of cyberattacks targeting water and wastewater utilities has spread to at least seven U.S. states, prompting a federal investigation and urgent security warnings. The incidents, which began in late July, have disrupted operations but have not contaminated drinking water supplies, according to officials.

The attacks were first detected in Minnesota on July 26, where more than 30 community water systems were targeted, including facilities in Braham, Maple Plain, South St. Paul, and Plymouth. On August 1, Michigan officials reported that nine of its water systems had also been compromised. The Federal Bureau of Investigation is leading the investigation into the multi-state incidents.

Federal agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Environmental Protection Agency, issued a joint public alert on July 30. They warned that malicious actors are targeting internet-exposed programmable logic controllers (PLCs), which are industrial computers that manage pumps, valves, and chemical dosing. By breaching these devices, attackers have modified passwords and changed IP addresses to lock out operators, forcing some facilities to...