Share on LinkedInShare on LinkedIn

ARTICLE · 17 AUGUST 2026

Rising Cyberattacks On U.S. Water Infrastructure: Federal Guidance And Next Steps For Operators

Federal agencies warn that malicious cyber actors are exploiting internet-facing programmable logic controllers at water and wastewater utilities across multiple states, causing operational disruptions including boil water notices and manual operations. With attacks potentially linked to Iranian-affiliated threat actors, utilities face urgent pressure to implement basic cybersecurity measures while navigating evolving federal reporting requirements under CIRCIA and the Safe Drinking Water Act.

United StatesTechnology

Key Points:

  • Cyberattacks on water utilities are on the rise, with utility companies in at least seven states reporting incidents affecting water operations to the Federal Bureau of Investigation (“FBI”) since July 27, 2026.
  • The FBI, Environmental Protection Agency (“EPA”), and Cybersecurity and Infrastructure Security Agency (“CISA”) recommend taking immediate action: remove programmable logic controllers (“PLCs”) from direct internet exposure, change default passwords, and route remote access through virtual private networks (“VPNs”) or gateways.
  • Utilities should review their incident reporting obligations under various regulatory regimes, including the Safe Drinking Water Act and pending regulations under the Cyber Incident Reporting for Critical Infrastructure Act (“CIRCIA”), which are expected to be finalized in September 2026.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from