Iran-Linked Hackers Hit U.S. Water Systems in 7 States

The FBI is investigating a wave of cyberattacks targeting water systems across at least seven U.S. states, with officials suspecting Iranian-backed hackers are responsible. Georgia and Michigan are the latest states to confirm hostile cyber activity, joining Minnesota and others in what has become a coordinated campaign against critical infrastructure. The attacks began between July 26 and 27, 2026, when hackers targeted more than 30 community water systems in Minnesota. The FBI advisory, posted last week, confirmed that "since 27 July 2026, Water and Wastewater Sector (WWS) utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations." Michigan officials reported nine water systems experienced hostile cyber activity, while Georgia also confirmed it was affected. The attackers are targeting programmable logic controllers (PLCs) made by Rockwell Automation and Allen-Bradley, specifically the MicroLogix 1100 and 1400 series. After gaining access, threat actors remotely modified passwords and disconnected devices by changing IP addresses, locking out operators. In some cases, attackers modified PLC project files, causing loss of water pressure and flooding. A broader CISA advisory warned that Schneider Electric, Siemens, and other PLC brands are also being targeted. Security researchers at Tenable were among the first to publicly suspect Iran's involvement, citing similarities with previous attacks by the CyberAv3ngers group, which the U.S. government says operates under Tehran's control. The FBI has not formally attributed the campaign but is investigating. The attacks have forced some utilities into manual operations. A memo from the Minnesota Bureau of Criminal Apprehension stated the hackers' goal appeared to be "to cause loss of system pressure and subsequent potential contamination of water supply." No contamination or public health consequences have been reported, though some utili