Cyber warfare is increasingly coming for U.S. water supplies.
Water providers in at least seven U.S. states have been targeted by cyberattacks over the past two weeks, according to multiple agencies including the FBI, the Environmental Protection Agency (EPA), and the Cybersecurity and Infrastructure Security Agency (CISA). Some officials indicated that as many as a dozen states could have been impacted.
The hackers targeted components known as programmable logic controllers, which allow utility providers to manage the flow and even chemical composition of water supplies to the homes and businesses they serve, according to the agencies. In many cases, they “modified passwords to lock out operators and disconnected the [controllers],” CISA said in a recent advisory.
There are still no indications that the cyberattacks have caused major disruption or lasting damage to water supplies—at least some of the operators were reportedly able to switch to manual operations or use backup systems. However, CISA said that they were serious enough in some cases to have “resulted in boil water notices” to affected people.
The implications of the attacks are more severe, however. Programmable logic controllers help operators regulate the flow, distribution, and even chemical composition of the water supply. There have been a few close calls: In 2021, a hacker reportedly attempted to increase chemical levels at a Florida plant before being discovered in time, and in 2024, an attack caused a tank in Texas to overflow.
