America’s water systems are getting hacked amid security gaps: “No one guarding these systems”

Water Utilities Face Growing Cyber Threats as Security Weaknesses Exposed

Wertynews.com – Public water facilities across the United States are experiencing a surge in digital intrusions, prompting officials to highlight critical vulnerabilities within utility networks. Security specialists indicate that cybercriminals are capitalizing on a specific type of industrial computing device that remains inadequately protected. According to government representatives, these breaches may originate from hackers affiliated with Iran.

Utilities in more than twelve states have encountered these digital assaults. Authorities confirm that drinking water quality remains unaffected, and service providers have rapidly restored operational control. Nevertheless, cybersecurity professionals emphasize that these episodes reveal persistent deficiencies in thousands of municipal water networks, many of which depend on internet-linked industrial computers with insufficient security measures.

The Vulnerable Technology at Risk

Programmable logic controllers, commonly referred to as PLCs, serve as the backbone for industrial operations. These devices manage essential functions including regulating water pressure and dispensing treatment chemicals. The Cybersecurity & Infrastructure Security Agency highlighted in a July 30 advisory that numerous PLCs maintain active internet connections, creating pathways for unauthorized access. Security analysts informed CBS News that certain controllers either lack authentication credentials entirely or utilize passwords that are straightforward to deduce.

“The bottom line is there’s no one guarding these systems,” Joshua Corman, executive in residence for public safety and resilience at the Institute for Security and Technology, a security think tank, told CBS News. “These systems were directly on the internet with no firewalls or VPNs or anything, with no passwords set in most cases.”

Michael Garcia, policy director of the Operational Technology Cybersecurity Coalition, explained that water infrastructure presents attractive targets because they represent “low-hanging fruit” for opportunistic attackers.

Scope of the Incidents

While reports confirm attacks across twelve states, Garcia noted that the actual number could be substantially higher. The absence of mandatory federal reporting requirements means many local utilities may not have disclosed their experiences.

“There’s nothing that requires [utilities] to say, ‘Here’s all the information that we have. Here’s how it happened,'” Garcia said. “This [disclosure] has really been on a goodwill basis, so we actually don’t even know the large-scale impact, if there is one.”

Confirmed incidents include the following locations:

Georgia: The Clayton County Water Authority, providing service to 300,000 residents, reported a July 27 intrusion.

Michigan: State authorities indicated that several communities experienced disruptions during July.

Minnesota: Over thirty municipal water facilities faced challenges in late July.

New Jersey: At minimum, two municipalities encountered cyberattacks, though state representatives chose not to identify them publicly, per local ABC coverage.

South Dakota: KOTA-TV reported that a wastewater processing facility in Rapid City was compromised in late July.

Understanding the Attack Methods and Objectives

CISA described how intruders exploit exposed PLCs by altering IP addresses to disconnect devices and prevent operator access. The FBI’s July 30 declaration revealed that affected utilities experienced both flooding incidents and pressure reductions. In Clayton County, the interference triggered a boil-water advisory before services resumed within several hours.

Several facilities lost essential remote monitoring functions, compelling operators to transition to manual operations. Hackers successfully accessed pumps, valves, and pressure controls in multiple instances. Security professionals observed that utilities typically regained control by disconnecting systems and implementing manual oversight.

Corman warned that future attacks could produce more severe consequences, including pressure surges capable of rupturing pipelines and threatening vital institutions like medical centers.

“No water means no hospital in two to four hours,” he said. “A loss of water pressure might look like an inconvenience for the water sector, but it could actually be a mass casualty event for the hospital that depends upon it.”

Without any public attribution, the attackers’ precise goals remain uncertain. However, experts suggest that Iran-affiliated hackers might be pursuing psychological retaliation related to American-Iranian tensions, potentially aiming to communicate with the Trump administration or generate civilian anxiety.