The Cybersecurity and Infrastructure Security Agency (CISA) has revealed that over 100 water and wastewater systems across the United States were targeted by hackers in July 2026. These cyberattacks focused primarily on internet-connected programmable logic controllers (PLCs), which are critical devices that manage the physical operations of water and energy infrastructure. The scale of the attacks marks a significant increase in the ongoing efforts to compromise essential services in states including Michigan, Minnesota, and at least five others.

The assaults largely exploited PLCs produced by companies such as Rockwell, Schneider Electric, and Siemens, with recent intrusions involving AI-generated scripts tailored to vulnerable Siemens systems. Although the breaches have caused some operational disruptions and outages, water and wastewater service supplies to the public have generally remained intact. However, some attackers were able to manipulate PLCs to disable safety shutdowns and alarm systems, raising concerns about the potential for creating unsafe conditions unnoticed by operators.

U.S. intelligence officials suspect that Iran is behind many of these opportunistic cyberattacks, likely in retaliation for ongoing conflicts involving the U.S. and its allies. While definitive attribution remains unconfirmed, this pattern fits into a broader geopolitical context of hostile cyber activity targeting American critical infrastructure. The incidents underline growing worries about the resilience and cybersecurity defenses of vital services across rural and isolated regions in the country.

Beyond Iran, the report highlights that other global actors like China and Russia have been linked to cyber operations threatening critical infrastructures internationally. These efforts include pre-positioning destructive malware in U.S. systems and coordinated attacks on European power grids, all pointing to a strategic campaign aimed at testing and disrupting allied security networks. The recent water system intrusions reinforce the urgent need for strengthened protections against increasingly sophisticated cyber threats to essential public utilities.