Why US water systems are vulnerable to foreign cyberattacks

Hidden Vulnerabilities in American Water Infrastructure Revealed by Coordinated Cyber Intrusions

Sandego.net – A series of coordinated cyber intrusions targeting water facilities across twelve American states has laid bare decades of insufficient investment in critical infrastructure. The attacks, which occurred during an intense summer heat wave, demonstrate how foreign adversaries have positioned themselves to disrupt essential services that millions of Americans rely on daily. While the immediate threat to public health was contained, officials are now questioning whether the hackers held back from causing even more severe consequences.

What Happened and Why It Matters

The Federal Bureau of Investigation confirmed that the cyber intrusions resulted in water pressure drops and flooding at several facilities. State and local authorities verified that drinking water safety was not compromised during these incidents. However, the timing and nature of the attacks have raised serious concerns among security experts. Had the hackers manipulated devices responsible for monitoring chemical dosing, the safety of the nation’s drinking water supply could have been jeopardized on a much larger scale.

One US official expressed this concern directly:

Do we have the C team and they couldn’t do worse? How bad could it be if the A team turned to the US?

The question highlights a growing anxiety about whether the current wave of attacks represents a limited probe or a prelude to more devastating operations. Iran remains the primary suspect in these intrusions, though US officials have not yet formally confirmed Tehran’s involvement. For years, intelligence agencies have warned that sabotage-capable hacking teams from Russia, China, and Iran have been developing access to sensitive industrial networks across the country, waiting for an opportune moment to strike.

The Soft Underbelly of American Infrastructure

Local water and power plants that serve military facilities and civilian populations alike have emerged as prime targets. These facilities represent what security analysts call the soft underbelly of American infrastructure—critical but often overlooked components of national security. Water system operators in modest-sized towns and counties are now at the forefront of investigating one of the most serious cyberattacks on the sector in recent memory.

The geographic scope of the attacks spans from South Dakota to Georgia, demonstrating that no region is immune. Caitlin Durkovich, who served as deputy homeland security adviser in the Biden White House, emphasized the strategic logic behind targeting water systems:

It’s no secret that water utilities are under-resourced and vulnerable to cyberattacks, and it’s no secret that our adversaries know it. By targeting critical infrastructure, they can undermine public confidence in our leaders and impose significant costs with relatively little effort. They’ve spent years positioning themselves for exactly this kind of disruption.

Local Responses and Recovery Efforts

In central Georgia, the Clayton County Water Authority became one of the first organizations to publicly address the incident. Erin Thomas, a spokesperson for the authority, explained that her team had never experienced a malicious cyber incident at this scale before. The water authority is currently investigating unauthorized cyber activity that may have caused a water pump station to fail, triggering a boil-water notice in the early hours of July 27.

Our main concern when this happened was to make sure that we got the system up and running,

Thomas told CNN. The authority accomplished this recovery in a matter of hours on July 27.

Meanwhile, in Rapid City, South Dakota, officials announced on July 31 that a cyber incident had hit one of the lift stations serving the city’s wastewater system. Mike Theis, Rapid City’s public works director, noted that the city was not surprised by the possibility of being targeted by a foreign adversary, particularly during wartime. Theis credited the quick action of employees who noticed abnormal behavior on computer systems and isolated them from the internet, preventing further damage.

Policy Responses and Future Challenges

The hacking incidents have already triggered significant federal and state policy responses. New York Governor Kathy Hochul, a Democrat, announced approximately $9 million in grants designed to strengthen the cyber defenses of water systems across New York State. On the federal level, Democratic Senator Adam Schiff of California plans to introduce legislation next week that would grant the Environmental Protection Agency greater authorities to help boost water cyber defenses, according to Schiff’s spokesperson.

Beyond immediate funding and legislative action, a deeper frustration has emerged among water-sector specialists and cyber experts. Despite decades of warnings, a substantial portion of critical infrastructure remains directly accessible from the internet. Marty Edwards, former head of the Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team, explained the root cause:

For the past 20 years, experts have been telling utilities to make sure their systems were not directly accessible from the internet. This recent set of intrusions is the result of complacency and a lack of budget prioritization.

Looking Ahead: Securing America’s Water Future

The attacks on water systems represent more than isolated incidents—they signal a fundamental shift in how foreign adversaries view American infrastructure. As climate change intensifies and digital connectivity expands, the intersection of physical and cyber vulnerabilities will only grow more complex. Water utilities, many of which operate with limited budgets and aging technology, face an urgent need to modernize their defenses while maintaining reliable service to communities.

The coming months will likely see increased federal oversight, expanded grant programs, and potentially new regulatory requirements for water systems. The question is no longer whether American water infrastructure will face continued cyber threats, but whether the nation can mobilize quickly enough to protect one of its most vital resources before the next attack strikes.