Over 100 water and wastewater systems across the United States were targeted in cyberattacks during July 2026, according to the Cybersecurity and Infrastructure Security Agency (CISA).

The attacks involved internet‑exposed programmable logic controllers (PLCs) linked to cellular modems, a configuration that CISA said can create significant security risks because the devices were not designed for direct online access.

The intrusions were observed in at least a dozen states, including Minnesota, Michigan, Georgia, South Dakota and New Jersey, and primarily affected small, rural utilities. CISA noted that the compromised PLCs represent a small fraction of the nation’s water utilities—about 0.5 percent—but the scale of the activity suggests a coordinated effort. Analysts suggested the incidents may serve as test runs for a larger campaign. While some experts have linked the activity to Iran‑affiliated actors, the U.S. government has not formally attributed the attacks to any group.

Matt Hartman, chief strategy officer at the Merlin Group and former acting head of CISA, said the scope of the attacks highlights systemic vulnerabilities in operational technology that was built for closed environments. John Gallagher of Viakoo and Cynthia Kaiser of Halcyon Ransomware Research Center also noted that the activity could be part of a broader strategy using AI‑generated exploitation scripts targeting Siemens S7 series PLCs. CISA’s advisory recommended disconnecting PLCs from the internet, routing remote access through VPN or gateway devices, implementing multi‑factor authentication, changing default passwords, and limiting allowed IP addresses to known engineering devices.

The agency emphasized that understanding the attack methods is a priority for defenders while attribution remains ongoing.