The FBI and the Environmental Protection Agency have warned of a series of cyberattacks on water supply and wastewater treatment facilities across seven US states, with incidents beginning July 27.
According to the FBI, attackers gained access to programmable logic controllers, then remotely changed IP addresses and passwords, leaving operators unable to control their equipment. Affected facilities reported drops in water pressure and flooding.
The agencies warned that pressure drops carry risks beyond service disruptions. Reduced pressure can allow untreated groundwater to enter pipelines, creating additional hazards for the broader water supply system.
Operators were advised to restrict direct internet access to equipment, use secure gateways and firewalls, strengthen passwords, and configure access control lists to allow data exchange only between trusted devices.
The warning followed attacks on more than 30 municipal water facilities in Minnesota.
