Attacking America Through its Wastewater

Since the end of July 2026, cyber attacks targeting water and wastewater utilities have been reported in at least a dozen states including Michigan, Georgia, South Dakota, Wisconsin, California, and others. In Minnesota specifically, more than 30 community water systems were impacted.

Some utilities have lost critical remote-control capabilities, forcing operators to switch to manual mode. In several cases, the hackers gained remote access to pumps, valves and water pressure. As of this writing, according to officials, the cyberattacks have had no impact on drinking water, which has remained safe. 

However, In Georgia, the Clayton County Water Authority, which serves 300,000 customers in the Atlanta area, said cyber activity last month caused a water pressure drop and forced the agency to issue a boil water advisory. Service was restored within hours, however.

Experts say the tactics resemble a 2023 campaign by the group calling themselves the Cyber Avengers, an organization linked to the Iranian Revolutionary Guard. In a recent interview with NPR, Rob Lee, the co-founder and CEO of Dragos, a cybersecurity firm focused on industrial technology, said, "I can't recall a time when there's been this many targets at once with operational impact." 

Lee told NPR he's aware of victims of this recent spate of attacks outside the water sector, as critical infrastructure operators tend to rely on the same technology. It's something Lee has been warning about for years. "This is pretty significant," he said.

The Cybersecurity and Infrastructure security agency, or CISA, says the perpetrators are targeting programmable logic controllers. They are urging critical infrastructure owners, operators, and integrators to remove publicly exposed controllers and other operational technology from the internet as soon as possible.

Furthermore, the FBI is asking anyone with information on the attacks to report it. On FBI.gov, the agency is saying "If you or someone you know has sustained similar OT outages, please contact your local FBI field office and file a complaint with the IC3 at ic3.gov. Additionally, you can contact CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). Be sure to include as much information as possible."

To hear about this and other stories impacting the world of Waste, Gas and Energy, check out the newest Recyclist news roundup here: https://youtu.be/o7FWom7KIe8