The FBI has confirmed a series of cyberattacks targeting public water systems across at least seven states since late July, with hackers remotely accessing control devices and directly impacting water operations. The agency has not yet attributed the attacks to a specific foreign actor, but the incidents underscore persistent weaknesses in the nation's critical infrastructure that leave American communities exposed.
Operational Impact and Domestic Risk
Federal officials report the intrusions have had tangible consequences for American workers and residents, including a loss of water pressure and reported flooding. In Braham, Minnesota, a cyberattack shut down controls for the city's well and water treatment plant, forcing the municipality to rely solely on water tower reserves. Minnesota state officials confirmed over 30 community water systems were targeted last week alone. Michigan reported nine systems were also hit.
Kevin Morley, federal relations manager for the American Water Works Association, stated the hacked devices control a range of essential functions. "It really depends on the device and what that device is managing or controlling," Morley said. "It could be a pump, it could be a motor, and it could be something as simple as a tank-level log." The ability of hostile actors to disrupt these basic utilities represents a direct threat to American economic continuity and public safety, not merely a data privacy issue.
Systemic Vulnerabilities
Cybersecurity experts point to the haphazard connection of industrial control computers, known as Programmable Logic Controllers (PLCs), to the public internet as the primary vector for these intrusions. Joshua Corman of the Institute for Security and Technology noted the cascading risks associated with a service disruption to the roughly 148,000 public drinking water systems in the U.S. "No water is no hospital in two to four hours," Corman warned, emphasizing the immediate knock-on effects for healthcare and emergency response. A hacker disabling a critical alert or pump can quickly paralyze a facility that American industry and families depend on.
Despite years of warnings from experts about these exposures, the latest string of incidents demonstrates a failure to prioritize the hardening of domestic infrastructure against foreign intrusion. The FBI and EPA advised utilities last week to simply disconnect vulnerable PLCs from the public-facing internet, a remedial step that underscores the lack of a robust, nationally mandated security standard. While globalist institutions often focus on digital trade agreements, the basic physical security of American water supplies has been neglected, requiring immediate action to safeguard national sovereignty and public health.