The 2026 Cyberattacks on U.S. Water Systems, Explained

[Jessica Kalvaitis]

Public water systems across the United States have become increasingly digitalized. Many utilities now use computers and technology systems to automate processes, monitor operations, optimize workflows, and more. While this digital transformation has brought several important benefits, a series of recent cyberattacks on the country’s drinking water and wastewater systems has renewed concerns about their vulnerability to these breaches.


In this article, we’ll explain why some municipal water systems in the U.S. are susceptible to cyberattacks and some potential real-world consequences of these digital intrusions. We’ll also discuss how to find out whether your local water utility has been affected and provide practical steps you can take to protect your water.

What is a Cyberattack?​

According to International Business Machines Corporation (IBM), a cyberattack is “a deliberate attempt to gain unauthorized access to a computer network, computer system, or digital device. The goal is to steal, expose, alter, disable, or destroy data, applications, or other assets.” In the water sector, these cybersecurity breaches can affect administrative systems and hinder the operational capacity of water utilities, disrupting and degrading water services relied on by millions of people.

The Rise in Cyberattacks on U.S. Water Infrastructure​

Cyberattacks on U.S. drinking water infrastructure are not new. However, they have become far more sophisticated, common, and coordinated since early incidents like the 2013 Bowman Avenue Dam intrusion in New York. From 2021 to 2025, ransomware attacks on water and wastewater systems rose by a whopping 500 percent, according to the Federal Bureau of Investigation’s (FBI) Internet Crime Reports for those years. Fast-forward to 2026, and water utilities in at least a dozen states have been affected by a hacking campaign, ABC News reports. Minnesota was the first to announce intrusions, with more than 30 communities attacked between July 26 and 27. Since then, similar breaches have been reported in multiple other states, including Alabama, Arkansas, Georgia, Michigan, South Dakota, and New Jersey.

What Effects Have the 2026 Attacks Had?​

The impact of these recent cyberattacks on U.S. water systems has varied. The FBI said in a press release that the “malicious cyber actors” targeted operational technology components, including programmable logic controllers (PLCs), human-machine interfaces, and sensors. Notably, the hackers remotely accessed internet-connected devices used by water utilities, locking out operators, and disconnecting systems by changing IP addresses and passwords. Some utilities reportedly lost critical remote-control capabilities, forcing operators to switch to manual mode. In Georgia, hackers shut down a pump station, causing pressure loss in certain areas and prompting a boil-water advisory as a precaution. Overall, no water quality issues were reported by the targeted utilities.


Related: What is a Boil Water Advisory and What to Do If One is Issued in Your Area

Why U.S. Water Infrastructure is Vulnerable to Cyberattacks​

U.S. national security officials have long warned about the vulnerability of the country’s water infrastructure to cybersecurity breaches. Yet, many of the nation’s nearly 170,000 water systems remain exposed. This sector is an attractive target for cybercriminals because water is an essential resource in daily life. Still, several longstanding factors have raised the risk of intrusion:

A Heavy Reliance on Legacy Digital Systems​

Much of the digital infrastructure being used by many utilities was engineered in an era before today’s heightened cyber risk environment. These legacy systems currently run on aging operational technology installed before modern cybersecurity protocols existed. Some of these systems are also difficult or impossible to retrofit with current security tools. Because of this, hackers can exploit technical weaknesses in these outdated technology systems, such as default or weak passwords, unpatched software, unsecured remote access points, and other cybersecurity flaws.

Exposing Vulnerable Industrial Control Equipment to the Internet​

PLCs largely drive water treatment plants. These small computers operate all sorts of industrial equipment and transmit operational data to a utility’s central computer system. However, many of these devices have reportedly been connected to external networks, remote-access platforms, and, in some cases, the open internet with no additional protections. This creates additional entry points for attackers to reach and seize control of the operational technology that helps control critical water infrastructure.

A Lack of Funds and Dedicated Cybersecurity Personnel​

Municipal water facilities in smaller jurisdictions generally face persistent worker shortages and often have limited financial resources or cybersecurity expertise to defend against attacks. That responsibility typically falls to general IT employees and other staff who are also charged with ensuring the utility continues to run at full capacity. Without a specialized, dedicated cybersecurity team, there are fewer or no trained personnel monitoring system security and guarding against increasingly sophisticated threats.

Legal Challenges Blocking Requirement for Cybersecurity Audits at Water Utilities​

The New York Times reported that in 2023, the Environmental Protection Agency (EPA) proposed creating stronger cybersecurity guidelines to better safeguard the nation’s water supply from cyberattacks. At the time, many municipalities lacked even basic protections, and the computers that monitor and adjust water quality, including chemical treatment levels, were easy targets for a would-be intruder. Despite repeated attacks that highlighted vulnerabilities in the nation’s water systems, the EPA withdrew the order after states and industry groups sued to block its enforcement. The opponents argued that the EPA lacked authority for the move and that smaller, underfunded utilities would struggle to adopt the new standards.

How Hacks of U.S. Water Facilities Could Threaten Drinking Water Safety​

A cyberattack on U.S. water facilities could compromise the drinking water quality and safety of millions of people, especially in communities with smaller utilities that are less equipped to handle large-scale water contamination. For instance, when intruders gain unauthorized access to digital systems that monitor and control operations, they can disrupt treatment processes, undermine monitoring systems, and increase the risk of public exposure to contamination. This could allow unsafe water to enter the supply, cause pressure losses that could increase the risk of contamination, or introduce unsafe doses of treatment chemicals into the water.

The 2021 Oldsmar, Florida Water Treatment Plant Cyberattack​

An example of the risk cyberattacks pose to drinking water safety is the 2021 incident in Oldsmar, Florida. Hackers remotely accessed a software program linked to other systems and attempted to poison the city’s water supply by increasing the amount of sodium hydroxide, better known as lye, in it. Utilities typically add small amounts of this additive (about 100 parts per million, ppm) to control the water’s pH. However, the attacker tried to boost that to 11,100 ppm, high enough to damage skin and cause hair loss if the water contacted the body, and potentially deadly gastrointestinal symptoms, if it was ingested. Fortunately, the operator at the plant immediately noticed the change and returned the levels of the caustic substance to normal.


Related: 3 Ways Data Centers’ Water Usage Is Impacting Drinking Water Quality

Cyber Regulations and Standards for U.S. Public Drinking Water Systems​

Cybersecurity requirements for U.S. water utilities include a mix of federal obligations and voluntary industry guidance. Under the America’s Water Infrastructure Act (Section 1433), community water systems serving more than 3,300 people are legally required to conduct risk and resilience assessments that address cybersecurity threats and to develop or update emergency response plans accordingly. These must be recertified every 5 years and explicitly cover cyber threats, not just physical and natural hazards. Some states, including New York, have started creating their own cybersecurity rules for public water systems.

Proposed Cybersecurity Regulation for U.S. Water Utilities​

Following this latest series of attacks on the U.S. water sector, a bill has been introduced to “amend the Safe Drinking Water Act and the Federal Water Pollution Control Act to establish or modify cybersecurity requirements for drinking water and wastewater systems, and for other purposes.” If passed, the Water Cyber Shield Act of 2026 would allow the EPA to require utilities to address vulnerabilities it identifies and to mandate that large utilities assess cybersecurity risks as part of their existing risk and resilience planning. The legislation would also:

• Direct the EPA to establish tiered cybersecurity standards in consultation with the Cybersecurity and Infrastructure Security Agency (CISA), National Institute of Standards and Technology (NIST), states, and water sector stakeholders.
• Authorize an additional US$300 million annually for each of the Drinking Water State Revolving Fund and Clean Water State Revolving Fund. The combined US$600 million in funding would be dedicated to cybersecurity improvements at water and wastewater utilities.
• Give smaller utilities and systems with fewer resources more flexibility and higher priority for federal financial assistance, and establish a technical advisory committee to give utilities a role in developing practical cybersecurity standards.
• Extend federal cyber incident reporting requirements to state- and locally-owned drinking water and wastewater systems that were previously exempt.

As the bill works its way through congressional committees and debates, the FBI’s memo suggests several old-school fixes water utilities can implement to limit cyber intrusions: change passwords, isolate networks, and go offline.

How to Check if Your Local Water System is Affected By a Cyberattack​

If you’re concerned whether a cyberattack or other disruption has impacted your water supply, start with your local utility. Its website and social media pages are the quickest and most reliable sources of information on service disruptions, changes in water pressure, boil-water advisories, and other customer instructions. You can also check your city or county’s website or emergency information channels for water-related warnings, such as active advisories and incidents affecting communities. Consider signing up for local text or email alerts if your community offers them. Finally, if you don’t know the name of your water provider, check the EPA’s Local Drinking Water Information page to identify it and access state drinking-water information.

What Can You Do to Protect Your Water?​

If a cyberattack on your local water utility compromises the quality and safety of your drinking water, having a reliable water filter system at home is key. With a treatment system installed, you can guard against potentially toxic water contaminants, such as heavy metals, pathogens, chemicals, and organic compounds, and enhance the water’s taste, smell, and appearance.

Choosing the Right Water Filter​

For the most comprehensive water protection, consider investing in a whole-house water filter. These point-of-entry systems are installed at your home’s main water line and treat every drop of water entering your home. That means clean, filtered water at every outlet and not just your kitchen faucet. If you want filtered water at specific household locations, such as your kitchen sink, an under-sink reverse osmosis system may be the solution.



Learn more: Is a Whole Home Water Filtration System Worth the Investment? | Reverse Osmosis Water Filtration, Explained

Final Thoughts​

The recent spate of attacks on U.S. water infrastructure exposes vulnerabilities in the underlying digital framework and highlights the urgent need to improve the security of our water systems. Some important immediate measures for utilities are to change default login credentials, use stronger passwords, limit PCLs from direct internet exposure, and apply firewall protections. Long-term, they should implement structured cybersecurity risk-management programs using CISA/EPA resources and assessment tools. In the meantime, homeowners should consider investing in a water filter system to proactively protect their water from contamination caused by cyberattacks or other disruptions.


For help finding a suitable water filter for your needs, contact SpringWell today to talk to a water expert or use the “Find My System” feature on our website.



The post The 2026 Cyberattacks on U.S. Water Systems, Explained appeared first on SpringWell Water Filtration Systems.