Wednesday, December 15, 2021
The FBI says hackers have breached internet-exposed controls at water and wastewater utilities in at least seven states, changing settings and disrupting service, as federal agencies press utilities to secure their systems.
Federal investigators say hackers have been breaking into the online controls that run water and wastewater plants, and the disruptions are already real. In an alert issued July 30, 2026, the FBI reported that malicious cyber actors reached internet-exposed programmable logic controllers, the small industrial computers that open valves and run pumps, then changed their IP addresses and passwords and locked operators out of monitoring and control. Water and wastewater utilities in at least seven states have reported incidents, and that count is expected to grow as more systems are checked.
The damage has not stayed theoretical. The FBI documented a loss of pressure and flooding at affected systems, and one operator found altered control files only after noticing that the plant logic no longer matched across several sites. A separate wave in July knocked utilities in more than 30 Minnesota communities back to manual operation, and last year the country's largest water company took its billing systems offline after an intrusion. Federal agencies are treating this as a national problem. The FBI, CISA, the EPA, and the NSA issued a joint advisory urging every utility to lock down its systems.
Where it stands now, this is an active and widening campaign rather than a single closed incident. The guidance to operators is blunt. Pull control systems off the public internet, replace default and reused passwords, wall off access with firewalls, watch for unauthorized changes, and keep the ability to run the plant by hand. That last point is the tell. When professionals are told to be ready to operate manually, households should hear the same message about their own water.
Your tap depends on a chain of pumps, sensors, and treatment steps that a keyboard hundreds of miles away can now interrupt. That is why a home reserve matters, so it is worth learning water storage before a service alert reaches your area. If an attack forces a boil-water notice or drops treatment, knowing how to run your own water purification keeps what you have safe to drink. For a longer disruption, rainwater collection stretches your supply for cleaning and the garden.
A cyberattack on the water system is a reminder that modern infrastructure fails in modern ways, and the fix at home is the same old discipline. Store water, keep a way to purify it, and do not assume the tap will always answer. Be Prepared Not Scared.
