In late July continuing into August, at least 12 states have reported cyberattacks on their water and wastewater infrastructure. The attacks led to operational disruptions, and in some cases boil-water notices had to be issued.

The nature of the attacks—including their sophistication and lack of ransom demands—seems to indicate a coordinated effort by a foreign country, with strong circumstantial and intelligence evidence pointing to the Islamic Republic of Iran (although there has been no public final attribution from the US government).

According to a press release from the FBI, after remotely accessing internet-facing operational technology (OT) devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality. (OT devices include remote-controlled switches, valves and pumps.)

To reduce the risk of compromise, the FBI and EPA recommend removing programmable logic controllers (PLCs) from direct internet exposure via secure gateway and firewalls, setting up strong, unique passwords, and utilizing an access control list (ACL) to allow only authorized communication between expected control system devices.        

Why Target Water?

Cyberattacks on the nation’s water infrastructure are, unfortunately, nothing new.

In February 2021 an attack on the water treatment plant in Oldsmar, Florida by an unauthorized user briefly manipulated sodium hydroxide levels from 100 parts per million to a dangerous 11,100 ppm (though a vigilant operator immediately reversed the change).

In November 2023, an Iran-backed cyber group known as Cyber Av3ngers attacked the Municipal Water Authority of Aliquippa in Beaver County, Pennsylvania. Hackers disabled a booster station digital device used to regulate water pressure, though drinking water safety remained unaffected.

All of which begs the question: why water and wastewater systems? Why not the nation’s electrical grid, key manufacturing centers, or (the nightmare scenario) our nuclear power plants?

The short answer is that our water infrastructure was built around reliability, not security.

The SCADA Problem

Melvin Newman is CEO and Co-Founder of Patabid, an AI-powered estimating platform. He has worked as a Chief Estimator and technologist, and has written for CONTRACTOR on cybersecurity issues.

“Some of these water treatment plants were built in the ‘50s and the ‘40s—especially in some of our major metropolitan areas like New York, San Francisco and Los Angeles,” Newman said. “They have comparatively ancient water treatment systems that are controlled by equally ancient technology because those systems are extremely reliable. But they were never secure.”

Those decades-old analog control systems were never designed to be connected to the Internet. All the same, they were later connected via IoT (Internet of Things) devices meant to improve control and monitoring. That convenience came at a price. “Now they can accidentally remove the air gap between SCADA and the internet,” Newman said. 

SCADA stands for Supervisory Control and Data Acquisition, a combination of software and hardware used to monitor and control industrial processes. It lets workers gather real-time data from machines, view operations on a computer screen, and manage equipment locally or remotely.

While SCADA systems were once isolated on private networks, modern integration with corporate IT networks and the Internet has greatly expanded their attack surface. “The SCADA systems are tiered, so they progressively report further and further up,” Newman said. “If you get into the control system for a pumping station you can work your way through the SCADA network all the way up to the primary control center.”

The Human Factor

But no matter the industry, it is always human behavior that is the greatest cybersecurity vulnerability. That includes weak or re-used passwords, mis-configured software, falling for phishing schemes, and overall poor data hygiene.

As an example of poor data hygiene, Newman cites the Stuxnet virus, a cyberweapon used against Iran in 2010 that managed to destroy roughly 1,000 uranium-enriching centrifuges by making them spin out of control while faking normal sensor data. The virus made its way into an air gapped (that is, not connected to the Internet or any other computer network) system when a worker at the nuclear plant loaded a USB flash drive—probably out of simple curiosity.

The Drop in the Bucket

To help reinforce the nation’s water security, the Water Resources Development Act (WRDA) of 2026 currently making its way through Congress would (when passed and signed into law) reauthorize the Drinking Water Infrastructure Resilience and Sustainability Program to address cybersecurity vulnerabilities at $25 million annually.

Altogether, including public, private and specialty facilities, there are approximately 23,000 wastewater treatment facilities in the US, which works out to $1,087 each. Even if the money is focused on the most densely populated areas of the country, it is simply not nearly enough.

Melvin Newman believes the country needs an approach to cybersecurity similar to the US Navy’s attitude to damage control systems and procedures in World War Two—not functionally, but in terms of the thought-process.

“How did they incentivize and properly train people to become such an unstoppable force?” Newman said, “and how do we engender that facility in our municipal workers who are managing these plants and are often critically understaffed?”