While the coordinated attacks on U.S. water systems began in late July, the same basic weakness is still being exploited.
Just days ago, on October 28, 2026, a Bloomberg investigation detailed how Russia-linked groups have been using poorly secured industrial controls to cause real physical damage—burst pipes, overflowed tanks, and spoiled food—across the West.
After Russia launched its full-scale invasion of Ukraine, Moscow-linked hacker groups began targeting not only the websites of government and private organizations in the West but also critical infrastructure and businesses, Bloomberg reported in a lengthy feature. Targets have included water facilities, factories, and food companies. The attacks have caused pipes to burst, food to spoil, and fires to break out.
GRU-Backed Hackers Burst Water Mains and Sparked Factory Fires From Denmark to California
The TechTimes mirrored Bloomberg’s report as well stating the Cyber Army of Russia Reborn (CARR) and its industrial-sabotage offshoot Z-Pentest — have deliberately moved beyond website defacements and distributed denial-of-service (DDoS) disruptions into a more dangerous mode of operations: using weak or default credentials on internet-facing industrial control systems to cause measurable physical damage to Western water utilities, food processing plants, factories, and waste treatment infrastructure.
On The Home Front
The July campaign against American water utilities remains one of the clearest recent examples of how easily those systems can be reached.
In late July 2026, hackers targeted operational controls at more than 30 municipal water systems in Minnesota. The activity then spread. Federal officials later said utilities in at least 12 states reported similar incidents.
“Since 27 July 2026, Water and Wastewater Sector utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations.”
— FBI and EPA Public Service Announcement, July 30, 2026
Minnesota was the first state to report the attacks publicly. Minnesota IT Services said the coordinated cyber activity hit operational technology at more than 30 community water systems on July 26 and 27. Most of the incidents involved devices used to monitor and control equipment remotely. Officials said drinking water quality was not affected and that no active requests remained for residents to change how they used water.
In Braham, Minnesota, a city of about 1,700 people, attackers shut down operating controls for the well and water treatment plant. Residents were asked to minimize water use for a few hours while the system ran on stored water from the tower. The city restored service. In Plymouth, Minnesota, communications to parts of the water infrastructure were interrupted and later restored. Other Minnesota communities, including South St. Paul and Maple Plain, also reported activity and switched to manual operations where needed.
Michigan later confirmed that nine of its water systems had reported activity consistent with the federal descriptions. Michigan’s Department of Environment, Great Lakes, and Energy said all systems continued to operate safely, local operators addressed the issues, and there were no known public health concerns.
The FBI and the Environmental Protection Agency issued a joint Public Service Announcement on July 30. It stated that since July 27, water and wastewater utilities in at least seven states had reported incidents, and some of the activity degraded operations. The attackers remotely accessed internet-facing programmable logic controllers, specifically Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series. They changed IP addresses and passwords, which caused a loss of monitoring and control. Reported effects included loss of pressure and flooding. Pressure loss can allow untreated groundwater to enter pipes.
Later reporting expanded the scope. Multiple outlets stated that utilities or state agencies in at least 12 states had been affected.
Publicly confirmed states include Minnesota, Michigan, Georgia, South Dakota, New Jersey, and Alabama. In Georgia, the Clayton County Water Authority reported a temporary disruption and issued a precautionary boil-water advisory. Service was restored within hours after testing showed the water was safe. In South Dakota, Rapid City reported an incident involving a wastewater lift station. New Jersey confirmed two incidents; officials said staff shifted to manual operations and there was no disruption to service. Alabama reported an attack on the Childersburg system that did not disrupt water services.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a
CISA later indicated that more than 100 internet-exposed water systems had been targeted during July. Federal agencies have not publicly named every state. They have also not issued an official attribution.
Multiple reports, citing U.S. officials and prior advisories, said the activity was consistent with Iranian-affiliated actors, including groups linked to the Islamic Revolutionary Guard Corps such as CyberAv3ngers.
A group calling itself APT Iran later claimed credit for the Minnesota attacks and said it was working with CyberAv3ngers.
Officials have noted that attribution is still under investigation and that a false-flag possibility has also been considered.
President Trump, speaking at a Cabinet meeting, said he did not believe Iran was responsible and blamed Minnesota officials, including Governor Tim Walz.
Governor Walz responded that other states had also been hit and that the administration had reduced resources at the Cybersecurity and Infrastructure Security Agency.
Iran-linked actors have targeted U.S. water systems before.
In 2016 the Justice Department charged Iranian hackers in connection with an attack on a small dam near New York City.
More recent advisories have warned that Iranian-affiliated groups were scanning and exploiting internet-exposed industrial controllers used in water, wastewater, and other critical infrastructure.
Water utilities across the country have long been considered a vulnerable sector. Many systems are small, underfunded, and operate older equipment with remote access that was never designed for modern internet threats.
The FBI and EPA recommended that operators remove programmable logic controllers from direct internet exposure, place them behind secure gateways and firewalls, use strong unique passwords, and restrict communications with access control lists.
As of late October 2026, public reporting shows no confirmed cases of widespread contamination or long-term loss of drinking water from this campaign. Most utilities restored full operations quickly.
The incidents have increased calls for baseline cybersecurity requirements and more funding for the water sector.
In a later incident, Colorado officials disclosed in mid-September that foreign actors had breached the control systems of two small privately owned water utilities in August. The attackers changed equipment settings, altered pumping cycles, disabled alarms, and cut off remote access. Operators regained control of the systems. The governor’s office confirmed that drinking water quality and treatment processes were not affected. The two systems together serve roughly 400 people. Reporting described the method as the same as the earlier Minnesota and Michigan attacks: internet-exposed industrial controllers that attackers could reach without sophisticated techniques.
How Does This Affect Us
Many “boil water advisories” have been issued across the country for ordinary contamination problems, but those were not connected to these cyberattacks.
Having said that, even water, no matter how carefully engineered, remains vulnerable once left open to the internet.
Human watchfulness and technology still fall short
before a God who sees everything.
No matter what nefarious methods are used against what he provides, there will come a day when those who walk in the works of darkness face the One who returns with a sword to bring judgment.
“Be sober-minded; be watchful. Your adversary the devil prowls around like a roaring lion, seeking someone to devour.”
1Peter 5:8
“So then let us not sleep, as others do, but let us keep awake and be sober.”
1Thessalonians 5:6
Keep the Faith and Stay In the Word
Until next time…
(Cindee Becker in collaboration with fellow researcher, Laurie Murphy)
Sources:
https://www.cbsnews.com/news/us-investigating-iran-cyberattack-minnesota-water-systems/
https://www.nytimes.com/2026/08/01/us/politics/iran-cyberattack-water-systems.html
https://www.csis.org/analysis/mapping-iranian-cyberattacks-us-water-systems
https://www.cbsnews.com/news/more-states-water-systems-cyberattacks-iran-backed-hackers/
Higher Ground News | highergroundnews@protonmail.com