US Warns Iran-Linked Hackers Are Targeting Water and Energy Systems

U.S. federal agencies are warning that Iran-linked hackers are actively targeting industrial control systems used by American water and energy providers, expanding a cyber campaign that officials say is intended to disrupt critical infrastructure. The updated alert comes months after the government warned of increased cyber activity by Iranian state-backed groups amid the ongoing conflict involving Iran, the United States and Israel.

In a joint advisory updated Wednesday, the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), the Department of Energy and the Cybersecurity and Infrastructure Security Agency (CISA) said the attackers have been compromising programmable logic controllers (PLCs) connected to operational technology networks. By manipulating the controllers, the hackers can alter information displayed to operators and potentially trigger outages or other operational disruptions.

Federal officials said the campaign was initially identified earlier this year after hackers targeted industrial controllers manufactured by Rockwell Automation. The updated advisory expands the list of affected systems to include products made by Schneider Electric and Siemens, indicating the campaign is broader than previously believed.

Critical infrastructure faces wider risk.

The agencies warned that “potentially all internet-exposed” industrial control systems could be vulnerable and urged owners and operators of critical infrastructure to strengthen their cybersecurity defences immediately. According to the advisory, the Iran-linked actors are conducting the attacks to create disruptive effects within the United States, likely in response to the continuing conflict involving Iran, the U.S. and Israel.

The FBI said investigators identified at least one incident in which hackers gained access to a critical infrastructure provider and modified the programming logic of industrial controllers. The changes disabled processes responsible for critical shutdown functions and safety alarms, allowing systems to enter unsafe operating conditions without alerting facility operators.

Part of a broader cyber campaign

The latest warning follows a series of cyber operations attributed to Iranian government hackers and affiliated groups since the conflict escalated earlier this year. Recent activity has ranged from traditional cyber espionage and hack-and-leak campaigns to destructive attacks intended to disrupt organisations and damage digital infrastructure.

Among the most significant incidents cited by federal officials was a cyberattack targeting medical technology company Stryker. Authorities said the Iranian hacking group known as “Handala” remotely wiped tens of thousands of employee devices after compromising the company’s systems.

Water providers remain a target.

Handala also claimed responsibility for a data breach involving California water provider Cal Water in June. The group alleged it could disrupt the company’s water supply, although it did not provide evidence to support that claim.

Cal Water said it found no evidence that attackers had gained unauthorised access to its operational technology networks, which control water distribution systems. Nevertheless, the incident highlights growing concerns among cybersecurity agencies that water utilities and other critical infrastructure operators remain attractive targets for nation-state hackers.

The updated federal advisory urges organisations that operate industrial control systems to review their security measures, limit internet exposure wherever possible and monitor operational technology environments for signs of unauthorised access as Iran-linked cyber activity continues to evolve.