U.S. cybersecurity agency CISA said it observed cyberattacks targeting more than 100 internet‑exposed water and wastewater systems in July across multiple states. The attacks focused on programmable logic controllers used to control physical processes in water providers and other critical infrastructure. CISA's advisory said the intrusions involved PLCs from manufacturers such as Rockwell, Schneider Electric and Siemens, and that some allowed attackers to modify the controllers to disable shutdown functions and alarms, creating unsafe conditions without notifying operators. The disruptions caused outages and required incident response efforts, but no impact on water supply to communities has been reported. The affected systems were located in Michigan, Minnesota and at least five other states, with many situated in rural or isolated areas where service interruptions could affect large populations. Hackers used scripts derived from publicly available information and, in some cases, AI tools to target vulnerable Siemens PLCs, according to CISA. U.S. intelligence officials have indicated that Iran is likely behind the attacks, though a definitive attribution has not been made. Officials also noted that similar campaigns have been attributed to actors linked to China and Russia, which have targeted water, power and energy systems in Europe as part of broader strategic activities. Federal officials warned that the incidents reveal vulnerabilities in critical infrastructure security and urged water providers to assess their systems, patch known vulnerabilities and implement network segmentation. CISA said it will continue monitoring the sector and plans to issue additional guidance to improve resilience.