Hackers have breached water and wastewater systems in at least 12 US states, according to sources who spoke with ABC News on October 18, 2026. Those sources said there has been no widespread disruption to drinking water supplies or wastewater treatment so far, even as the confirmed footprint of the campaign keeps growing. Michigan State Police said they are monitoring the situation and coordinating with federal partners, while the identity and motive behind the intrusions remain officially unconfirmed.
The timing matters. Water utilities sit near the bottom of almost every ranking of critical infrastructure cybersecurity spending, many still run industrial control systems installed decades ago, and most small municipal plants have no dedicated security staff at all. Earlier federal reporting had already tracked water system intrusions in seven states before this latest count jumped to 12. That expansion, reported by multiple outlets over the past day, turns a regional story into a national one.
What’s Confirmed About the Water System Cyberattacks So Far
Start with what reporting actually supports. ABC News cited sources describing possible cyber intrusions targeting water and wastewater utilities in at least 12 states, and those same sources said there had been no widespread disruption to water supplies or wastewater treatment. Michigan State Police confirmed publicly that they are tracking the situation and working alongside federal partners, a sign the response has moved beyond individual utility IT teams into state-level coordination.
That 12-state figure builds on an earlier wave of federal reporting that placed the known scope at seven states. The gap between those two numbers is not fully explained in current reporting, and it is not clear whether the additional five states represent new intrusions, newly disclosed older ones, or a mix of both. What is consistent across every account is the emphasis that monitoring and control functionality, not the water itself, has been the primary target.
Which States and Utilities Are Affected
Five states have been publicly named across the reporting tied to the earlier seven-state tally: Michigan, Minnesota, Georgia, New Jersey and South Dakota, according to coverage from al.com. The remaining states that make up the newer 12-state count have not been identified in available reporting as of October 18, 2026. That gap is itself notable. It means roughly half the states swept into this story are still unknown to the public, even as the overall number keeps climbing.
| State | Reporting Status | Key Detail |
|---|---|---|
| Michigan | Named, confirmed response | Michigan State Police said they are monitoring the situation and coordinating with federal partners |
| Minnesota | Named, largest reported impact | More than 30 community water systems reported affected, some switched to manual operation |
| Georgia | Named in earlier federal reporting | Included among water and wastewater utilities affected |
| New Jersey | Named in earlier federal reporting | Included among water and wastewater utilities affected |
| South Dakota | Named in earlier federal reporting | Included among water and wastewater utilities affected |
| Remaining ~7 states | Not publicly identified | Counted in the newer “at least 12 states” figure but unnamed as of Oct. 18, 2026 |
Minnesota stands out in the table above because it carries the most granular public detail. More than 30 community water systems in the state were reported affected, and some of those utilities lost remote-control capabilities entirely, forcing operators back onto manual control of plant equipment. That kind of fallback works, but it is slower, more labor-intensive, and leaves far less margin for error during nights, weekends, or staffing shortages.
Inside the Attack: Pumps, Valves and Manual Overrides
The mechanics described in federal reporting follow a pattern security researchers have warned about for years. In some cases, attackers gained remote access to pumps, valves and water-pressure controls, the kind of equipment that normally sits behind a utility’s supervisory control and data acquisition layer. The reported effect was degradation or loss of monitoring and control functionality rather than contamination of the water itself, which lines up with the “no widespread disruption” framing that sources gave ABC News.
Ahmad Taha, an associate professor of civil and environmental engineering at Vanderbilt University, put the stakes bluntly when describing what cyberattacks against water systems can do. “The impact of cyberattacks can be catastrophic, with very little effort,” Taha said, in remarks reported by Newsweek. That asymmetry, a small intrusion against an unpatched controller potentially cascading into a plant-wide shutdown, is the reason this story has drawn attention well beyond the water sector itself. It echoes the exposure security teams flagged in last month’s Danfoss controller exposure case, where hundreds of industrial controllers sat reachable from the open internet with no meaningful authentication layer in front of them.
Is Iran Behind the Campaign? Separating Fact From Assessment
This is the part of the story that demands the most care. Iran’s involvement in the water system intrusions has not been officially confirmed by any US government agency. ABC News attributed the Iran assessment to unnamed sources while explicitly noting that it has not been officially confirmed, and the Center for Strategic and International Studies has separately tracked a pattern of Iranian cyber activity against US water infrastructure dating back several years, without that history alone proving responsibility for this specific wave.
Jake Braun, a former acting principal deputy national cyber director at the White House, offered his own read on the situation. “It appears this is a shot across the bow from Iran,” Braun said, according to NPR. That is Braun’s personal assessment, not a confirmed government attribution, and it is worth holding those two things apart. Attribution in cybersecurity cases typically takes weeks or months of forensic work, and premature public blame has backfired on investigators before. For now, the honest summary is that Iran is a suspected actor discussed by sources and outside experts, not a confirmed one.
Why Water Utilities Keep Getting Hit
Ask the people who study operational technology why water keeps showing up in these headlines, and the answer is almost always the same: exposure, not sophistication. Patrick Gillespie, OT practice director at GuidePoint Security, described the pattern plainly. “The reason this is happening right now is these are inherently insecure devices that are directly connected to the internet,” Gillespie said, in comments carried by StateScoop. That single sentence explains why a small-town treatment plant with no IT department can end up in the same incident report as a 12-state federal investigation.
Mauricio Papa, a professor of computer science at the University of Tulsa, framed the underlying tension as a tradeoff utilities keep making without fully pricing the risk. “Technology is always evolving, and we want to connect everything to the internet, it’s so convenient,” Papa told StateScoop. Convenience wins budget arguments that security rarely does, especially at utilities funded by rate-payer revenue rather than venture capital or federal grants.
Legacy OT Meets the Open Internet
Water is not the only sector learning this lesson the hard way this year. French retailers discovered a similar blind spot when attackers hit supermarket refrigeration controllers, and the fallout spread wide enough that regulators began warning US grocers about the same class of exposed equipment. Both cases share a root cause: industrial controllers built for isolated factory floors, deployed instead on networks that touch the public internet, often with default credentials or no authentication at all. Water utilities simply have more of that equipment, running longer, with less money to replace it. The remote-access tools utilities use to manage that equipment from off site carry their own risk, too. Attackers have repeatedly used flaws in VPN and firewall appliances, like the Ivanti Connect Secure zero-day and the actively exploited SonicWall flaw disclosed earlier this year, as a front door into networks that were never meant to face the public internet at all.
Water vs Other Critical Infrastructure Sectors on Cybersecurity
Compare water to the two sectors it keeps getting lumped in with in news coverage, energy and finance, and the regulatory gap becomes obvious. The power grid operates under NERC CIP standards, a binding federal framework that mandates specific controls, audits and penalties for utility operators. Banks face mandatory breach reporting and examination by federal regulators as a condition of staying in business. Water utilities have neither. The EPA has pushed for mandatory cybersecurity requirements tied to existing safe drinking water rules in recent years, and those proposals have repeatedly stalled, leaving the sector to rely on voluntary guidance and after-the-fact advisories from CISA rather than enforceable standards.
That gap is not a secret to the people running water systems. It shows up in staffing: large investor-owned utilities can afford a security operations team, while a rural district serving a few thousand households often shares one IT contractor across half a dozen plants. It shows up in procurement, too, since many of the industrial controllers still in service were purchased before remote connectivity was even a design consideration, let alone a security one. Closing that gap through regulation alone would take years. Closing it through incidents like this one, unfortunately, tends to move faster.
A Decade of Warnings: Oldsmar, Colonial Pipeline and Now This
None of this is a surprise to anyone who has followed critical infrastructure security since 2021. That February, an operator at a water treatment plant in Oldsmar, Florida, noticed someone remotely changing the chemical levels in the system and reversed the change before it reached the public supply. A few months later, the Colonial Pipeline ransomware attack shut down fuel deliveries across the Southeast for days, triggering gas shortages and a spike in pump prices that made the sector’s exposure a front-page story rather than a trade-publication one.
Both incidents produced the same cycle this story is now repeating: public alarm, congressional hearings, promises of new funding and regulation, and then a slow fade from headlines once the immediate crisis passed. Robert Powelson, president and CEO of the National Association of Water Companies, pointed at that pattern when calling for a different approach this time. “We need to be collaborating more than ever,” Powelson said, in comments reported by Cybersecurity Dive.
How This Compares to Major US Critical Infrastructure Attacks
Measured against other headline critical infrastructure incidents of the past five years, the current water sector campaign looks broader in geographic spread but, so far, less disruptive in direct consequence. That distinction matters for how seriously officials and the public should treat it.
| Incident | Year | Sector | Scope | Attribution | Outcome |
|---|---|---|---|---|---|
| Oldsmar water treatment plant | 2021 | Water | Single facility | Never publicly attributed | Operator reversed the change before it reached the supply, no injuries |
| Colonial Pipeline | 2021 | Fuel pipeline | Regional, Southeast US | DarkSide ransomware group, publicly attributed by the FBI | Multi-day shutdown, regional fuel shortages and price spikes |
| 2026 water utilities campaign | 2026 | Water and wastewater | At least 12 states, 7 confirmed earlier | Iran suspected by sources and outside experts, not officially confirmed | No widespread water supply disruption reported as of Oct. 18, 2026 |
The table underscores a point worth repeating: scale and severity are not the same thing. Twelve states is a wide footprint, but “no widespread disruption” is a materially better outcome than what Colonial Pipeline produced in 2021. Whether that holds depends entirely on how utilities respond in the coming weeks, not on how the story reads today.
Michigan State Police and the Federal Response
Michigan’s response offers a useful window into how states are handling this. State Police there confirmed they are actively monitoring the situation and coordinating with federal partners, language that suggests an information-sharing role rather than a standalone criminal investigation. That kind of state-federal coordination has become standard practice since CISA began publishing joint advisories on water sector threats, a track record documented in Tenable’s own writeup of the coordinated cyberattack on Minnesota water utilities, which ties the campaign to the kind of exploited-vulnerability tracking CISA maintains for internet-exposed control systems. Readers who want the mechanics of how agencies prioritize which flaws to patch first can see that process laid out in our CVSS versus CISA KEV comparison.
Separately, NBC Chicago reported that the government’s own understanding of the campaign’s scope grew over the course of its investigation, with officials acknowledging the situation was worse than initially described. That pattern, early undercounting followed by a larger revised figure, is common in slow-burn intrusion campaigns where forensic review takes months to catch up with the attacker’s actual footprint.
Market Impact: OT Security Spending Gets a Second Look
Water utilities are not venture-funded startups. Most are municipal entities funded by rate-payer bills, which means every dollar spent on network segmentation or a dedicated OT monitoring platform is a dollar that shows up on a resident’s water bill or gets debated at a city council meeting. That funding structure is the real reason the sector lags behind finance or energy on cybersecurity maturity, and it is unlikely to change overnight just because this story made national news.
What is likely to change is attention from vendors and insurers who already sell into critical infrastructure. Incidents of this scale tend to accelerate conversations utilities were already having about cyber insurance premiums, federal grant eligibility tied to security upgrades, and whether state regulators should mandate minimum controls like multifactor authentication on remote access tools. None of that produces an overnight market shift, but it does tend to move budget line items that had been stuck for years, the same dynamic that followed Colonial Pipeline in 2021 and, more recently, the wave of exposed industrial controllers uncovered in France’s retail refrigeration sector.
There is also a quieter effect on vendors that sell network monitoring and remote-access tools built specifically for operational technology. Every major water-sector incident since Oldsmar has produced a short-term bump in sales conversations for that category, as utility boards ask their engineering staff what a comparable attack would look like on their own network. Whether that translates into signed contracts depends on budget cycles that often run a year or more behind the news cycle, which is part of why the sector’s underlying exposure tends to persist well after the headlines move on.
What Utilities Are Doing Right Now
For affected utilities, the immediate priority has been containment rather than attribution. That means isolating compromised remote-access paths, rotating credentials on exposed systems, and in Minnesota’s case, reverting to manual control of equipment that had lost remote functionality. It also means a wave of calls to state and federal partners, which is exactly the coordination role Michigan State Police has described publicly.
Manual Operations as a Stopgap
Falling back to manual operation is not a failure response, it is a designed one. Water treatment plants are built with manual override capability precisely because automated control systems can fail or be compromised. The tradeoff is operational: manual control demands more staff on site, slower response to changing conditions, and far less tolerance for the kind of short-staffed night shifts that many small utilities already run. It buys safety at the cost of speed and labor, which is a sustainable choice for days, not months.
What Happens Next: 5 Predictions
- CISA and the EPA will likely issue an updated joint advisory specifically addressing this campaign, following the pattern set by earlier water-sector alerts tied to internet-exposed controllers.
- The remaining states behind the “at least 12” figure will probably surface gradually through state-level disclosures and local reporting rather than one coordinated federal announcement.
- Official US attribution to Iran is unlikely to arrive quickly, even if individual experts and lawmakers continue to say so publicly, given how long formal attribution investigations typically take.
- Expect renewed congressional interest in funding cybersecurity upgrades for small municipal water systems, echoing the grant proposals that followed the Colonial Pipeline attack.
- State public utility commissions in affected states will likely face pressure to require baseline controls, such as network segmentation and multifactor authentication on remote-access tools, for water utilities under their jurisdiction.
Frequently Asked Questions
How many US states have reported water system cyberattacks?
Sources told ABC News that intrusions have affected water and wastewater utilities in at least 12 states as of October 18, 2026, up from an earlier federal tally of at least seven states.
Was Iran responsible for the water system hacks?
Iran’s involvement has not been officially confirmed. Some sources and outside experts, including former White House official Jake Braun, have described the campaign as consistent with Iranian activity, but no US agency has publicly attributed the attacks to Iran.
Did the attacks disrupt drinking water supplies?
No. Sources told ABC News there has been no widespread disruption to water supplies or wastewater treatment, though some utilities lost remote monitoring and control functionality.
Which states have been publicly named?
Michigan, Minnesota, Georgia, New Jersey and South Dakota have been publicly identified in reporting tied to the earlier seven-state federal tally. The remaining states in the newer 12-state count have not been named as of this writing.
How many Minnesota water systems were affected?
More than 30 community water systems in Minnesota were reported affected, with some losing remote-control capability and switching to manual operation.
How did attackers get into water utility control systems?
Federal reporting described loss or degradation of monitoring and control functionality, with attackers in some cases gaining remote access to pumps, valves and water-pressure controls, typically through internet-exposed operational technology.
What is Michigan State Police’s role in the response?
Michigan State Police said they are monitoring the situation and coordinating with federal partners, functioning as a state-level liaison rather than running an independent criminal probe.
What should small water utilities do to reduce their risk?
Security practitioners point to basics that remain widely unimplemented at small utilities: removing direct internet exposure on industrial controllers, enforcing multifactor authentication on remote-access tools, and maintaining a tested manual-operation fallback for when automated systems go offline.