Water sector cyber incidents by year and record status
| Year | Incident | Where | Record status |
|---|
| 2021 | Oldsmar | Oldsmar, Florida, US | Contested |
| 2025 | Bremanger Dam | Bremanger, Norway | Hacktivist, per PST; unnamed |
| 2013 | Bowman Avenue | Rye Brook, New York, US | Charged, not convicted |
| 2024 | American Water | United States | Vector undisclosed |
| 2026 | US Water Campaign | At least seven US states | July wave unattributed |
| 2023 | CyberAv3ngers | Aliquippa, Pennsylvania, US, and other sites | US government attribution |
| 2020 | Israeli Water | Israel | Attacker undisclosed |
| 2025 | TwoNet Water Honeypot | Simulated plant (Forescout) | Honeypot, not a real utility |
| 2026 | ZionSiphon | No victim on record | Malware sample, no victim |
What the headlines got wrong about water sector cyberattacks
One widely repeated claim from each entry, and what the record says. Each entry lists more, with sources.
| Widely repeated claim | What the record says | Entry |
|---|
| "FBI and former city manager say Oldsmar cyberattack never happened." | The FBI said it "was not able to confirm" a targeted cyber intrusion. That is inconclusive, not exculpatory, and the sheriff's case is still open. | Oldsmar |
| "Hackers opened the dam's floodgates and released water uncontrollably." | One valve, the minimum flow valve, was opened fully. The owner put the extra flow at 497 liters a second against a flood calculation of about 20,000, and there was never a flood risk. | Bremanger Dam |
| "The Iranians meant to hit a bigger dam in Oregon and got the wrong one." | Inverted. The original reporting says US investigators initially thought the Oregon dam was involved. Nothing on the record says the intruder chose Bowman Avenue at all. | Bowman Avenue |
| "American Water was hit by a ransomware attack." | No American Water filing uses the word, and no group ever claimed the incident. The earliest dated attribution found is a doubly hedged speculation; the unhedged version cites nothing. | American Water |
| "Iran attacked US water systems in July 2026." | No government document attributes the July wave. The FBI and EPA say "malicious cyber actors"; Minnesota is "not attributing this activity to a specific actor." The Iranian-affiliated assessment belongs to the spring campaign. | US Water Campaign |
| "34 US water utilities were hacked." | At least 34 devices in US water, counted in December 2024. No document says how many utilities. One US water utility has been named, by itself. | CyberAv3ngers |
| "Iran tried to poison Israel's water." | No Israeli official has said it on the record. Israel has never attributed the attack; Iran is named only by unnamed sources in three outlets. | Israeli Water |
| "TwoNet hacked a Dutch water utility." | The only facility in the record is Forescout's decoy. Forescout says the group "falsely claimed responsibility for a real-world attack." The Dutch detail is The Record's account of the claim. | TwoNet Water Honeypot |
| "ZionSiphon attacked Israeli water and desalination plants." | No victim, intrusion, deployment or government advisory is on the record. Neither vendor reports finding it in any environment. The facility names are strings in the binary. | ZionSiphon |
BlastWave analysis: what stood between the intruder and the water
Analysis, not a disclosed factAcross the nine entries, the thing that stood between remote access and the physical process was most often a person or a procedure rather than an engineered limit: a sluice gate disconnected for maintenance at Bowman Avenue, an operator who saw the setpoint move at Oldsmar, staff running Aliquippa's booster station by hand, a guard who reached the Bremanger dam and found the valve open, and crews running Plymouth, Minnesota's system by hand in 2026. That is BlastWave's reading of the record, not a finding of any investigator. The entries' recommendations follow from it: remove the remote path to the controller, remove password-only access, and bound what a reachable controller can be told to do.
Frequently asked questions
What are the major cyberattacks on water utilities?
The Water edition documents nine: the Bowman Avenue Dam intrusion in New York (2013), the attempted attack on Israel's water systems (2020), Oldsmar, Florida (2021), the CyberAv3ngers defacements of Unitronics controllers including Aliquippa, Pennsylvania (2023), American Water (2024), the Bremanger dam in Norway (2025), the TwoNet honeypot intrusion (2025), the ZionSiphon malware sample (2026), and the July 2026 lockouts of water utility controllers in at least seven US states.
Has a cyberattack ever poisoned a water supply?
No entry in the Water edition records a confirmed change to the chemistry of treated drinking water. At Oldsmar in February 2021 a sodium hydroxide setpoint was raised 111-fold on screen and reversed within minutes, and the federal advisory says the treatment process was unaffected; in 2023 the FBI said it could not confirm a targeted intrusion. In July 2026 the FBI and EPA reported loss of pressure and flooding, and no primary document describes chemical tampering at a named US utility.
Has Iran attacked US water systems?
In 2023 a joint US advisory said IRGC-affiliated actors using the CyberAv3ngers persona defaced internet-facing Unitronics controllers, at least 34 of them in US water by a December 2024 count of devices, not utilities. In April 2026 an advisory described a spring campaign by Iranian-affiliated actors. As of late September 2026, no government document attributes the July 2026 lockouts to anyone. In the 2013 Bowman Avenue case one Iranian man was charged, not convicted.
Was the Oldsmar water plant really hacked?
It is contested. In February 2021 the Pinellas County sheriff described someone who appeared to be a bad actor. In 2023 the FBI said it was not able to confirm that the incident was initiated by a targeted cyber intrusion, which is inconclusive rather than a finding that nothing happened, and the sheriff's case remains open. The setpoint change itself is not disputed.
Which well-known water hacks turned out to be something else?
TwoNet's 2025 claim of disrupting a water plant concerned a decoy built and watched by Forescout researchers; no real facility was touched. ZionSiphon, published in April 2026, is a malware sample with no victim, intrusion or deployment on the record. American Water's 2024 incident is widely called ransomware, but no company filing uses the word and no group ever claimed it.
How does Hackopedia verify a water incident?
Every figure, date and quotation in an entry traces to a court record, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such, and each was checked against its source by hand. Claims resting on press or unnamed sources are marked as reported, and claims the record does not support are listed and corrected, including errors in Hackopedia's own first volume.
Other editions
Cite this page
BlastWave. “Cyberattacks on Water Utilities: The Verified Record (2013 to 2026).” Hackopedia, Volume 2, Water edition. Last verified 28 September 2026. https://hackopedia.blastwave.com/water/
Revision history
| Date | Change |
|---|
| 2 Oct 2026 | Water edition published with nine entries. FILE numbers run across all of Hackopedia Volume 2, not by edition. |
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
