Coordinated Cyberattacks Target Water Systems Across 12 States

Water and wastewater systems in at least 12 states have reportedly faced a coordinated series of cyberattacks, placing new attention on the technology local governments use to operate essential public infrastructure.

Axios, citing ABC News, reports that at least a dozen states are responding to attacks against local water systems. Officials have reported no drinking water safety concerns.

The campaign initially drew attention after attacks hit more than 30 water systems in Minnesota. Michigan later confirmed similar activity affecting nine systems.

Operators kept the affected Michigan systems running safely. In Minnesota, one community asked residents to conserve water for several hours after attackers shut down operating controls at its well and water treatment plant. The community continued supplying water from its water tower while crews worked to restore the system.

The FBI continues investigating and has not publicly identified who carried out the attacks. Federal officials suspect Iranian involvement, but they have not confirmed that assessment.

Most of the attacks targeted operational technology, according to officials. These systems allow utilities to monitor and control physical equipment, including pumps, wells, valves, storage tanks, and treatment systems.

An attack on those controls can interrupt service, damage equipment, or force operators to run systems manually. Axios reports that many of the devices targeted in the latest campaign should not have had direct internet connections.

Federal agencies have warned that water and wastewater systems remain attractive targets because many rely on older equipment, remote vendor access, and limited cybersecurity staff.

CISA recommends several steps to reduce those risks, including maintaining an inventory of information and operational technology, changing default passwords, requiring multifactor authentication, limiting unnecessary internet access, and conducting regular cybersecurity assessments.

Maryland law now sets cybersecurity requirements for community water and sewerage systems under Chapter 495 of 2025.

All community water and sewerage systems must designate a cybersecurity point of contact, participate in annual cybersecurity training, report cybersecurity incidents, and update their emergency response plans to address cyber disruptions.

Systems serving more than 3,300 customers must also adopt State cybersecurity standards, commit to a zero-trust approach, and complete a cybersecurity maturity assessment covering information and operational technology every two years.

The first maturity assessment and emergency response plan deadlines arrived on July 1. The Maryland Department of the Environment’s guidance explains the requirements and identifies State and federal resources available to help systems comply.

Water and wastewater systems represent one part of the challenge for local governments. Counties rely on connected technology to support emergency communications, transportation systems, public safety facilities, government buildings, and other essential services.

The expanding number of reported attacks shows why cybersecurity planning must extend beyond email, financial records, and office networks. Counties must also protect the technology that operates equipment and keeps public services running.

#MACoCon: Protecting County Infrastructure in the Digital Age

Cyber threats increasingly target the physical systems counties rely on to deliver essential services. The 2026 MACo Summer Conference will feature a timely discussion on protecting operational technology, managing vendor risk, strengthening incident response, and maintaining essential services during a cyberattack.

“Protecting County Infrastructure in the Digital Age” will examine emerging threats affecting local infrastructure and highlight practical steps counties can take to protect critical systems. Cybersecurity and local government experts will also discuss coordination across departments and the challenges of balancing connectivity, innovation, and security.

The session takes place Wednesday, August 12, from 1:15 pm to 2:15 pm.

MACo’s Summer Conference, “Build What’s Next,” takes place August 12-15, 2026, at the Roland Powell Convention Center in Ocean City, Maryland. For more information, visit the conference website.

Learn more about MACo’s Summer Conference: