Cyberattacks on US Water Systems

Between July 26 and 31, 2026, hackers took manual control away from water and wastewater utilities across U.S. states, Minnesota, Michigan, New Jersey, Georgia, and South Dakota among them, with more than 30 community systems hit in Minnesota alone. According to news, cyberattacks on U.S. water systems are suspected to be linked to Iran-backed hackers. Operators in Georgia's Clayton County Water Authority, serving 300,000 people near Atlanta, watched pressure drop and had to issue a boil-water advisory before service was restored within hours. In several cases, the hackers gained remote access to pumps, valves, and water pressure, though the cyberattacks have had no impact on drinking water, which has remained safe.   A hacking front calling itself CyberAv3ngers, an Iranian Revolutionary Guard Corps-linked group sanctioned by the US Treasury Department in February 2024, has since claimed the operation on Telegram, framing it as a warning rather than an attack: "our intention in attacking Minnesota was only to warn" of its abilities and its intention to retaliate against any country that poses a threat to Iran. That framing matters as it leaves us questioning whether an “actual” attack can take place.