CISA Confirms Over 100 U.S. Water Systems Targeted in Cyberattacks

The U.S. cybersecurity agency, CISA, said hackers have targeted more than 100 internet-exposed systems across the country’s water and wastewater sector as cyber threats against critical infrastructure continue to rise.

The agency said the affected systems were targeted as part of a broader wave of attacks against American infrastructure providers. The incidents provide additional context on the scale of recent cyber activity affecting water utilities in several states.

In an advisory, CISA said many of the attacks focused on programmable logic controllers (PLCs), devices used to control physical processes and machinery in water facilities, energy systems, and other critical infrastructure environments.

Hackers targeted industrial control systems

The affected PLC devices came from multiple manufacturers, including Rockwell, Schneider Electric, and Siemens. CISA previously warned that some attacks against Siemens PLCs involve AI-powered tools that rely on publicly available information to create scripts targeting vulnerable systems.

CISA has urged organisations operating exposed systems to follow security practices designed to reduce internet exposure and strengthen protections around critical infrastructure.

Although the attacks caused disruptions and outages during investigations, CISA said they have had limited impact on local water and wastewater services. Incident response teams have been working with affected providers to identify and address the breaches.

Previous CISA reports noted that some intrusions enabled attackers to modify PLC settings, including disabling shutdown processes and alarms. The agency warned that such activity could potentially create unsafe conditions without alerting operators.

Critical infrastructure faces growing cyber risks.

Many of the affected communities are rural or isolated, where disruptions to water systems can have broader effects on local populations.

Reports citing U.S. officials have suggested that Iran may be linked to some of the attacks targeting water providers, although officials have not made a final attribution. The incidents have increased concerns about the security and resilience of critical infrastructure across the United States.

U.S. officials have also warned about broader cyber threats from state-backed groups. China-linked hackers have been accused of placing malware within critical infrastructure networks that could be activated during a future conflict. At the same time, Russia has previously been linked to cyberattacks targeting infrastructure systems in Europe.