In April 2020 attackers went after the control systems at Israeli water and wastewater sites. Supply never faltered. The chlorine plot and the Iranian hand come from officials who would not give their names.
The most repeated sentence about this incident is that Iran tried to poison Israel’s water. No Israeli official has said it on the record. The record holds a statement that an attempted attack on control systems was handled with no harm to supply, and an alert telling water companies to change internet-facing passwords, with emphasis on the systems that add chlorine to wells. Coverage read the precaution as the finding, and an unnamed source supplied a plot to match.
The alert says something more useful. Change passwords on systems reachable from the internet, and disconnect where you cannot: that describes control screens answering from anywhere, with a password as the only question asked. That reading is BlastWave’s analysis. The one reported process event, a pump taken off automatic, ended with somebody noticing and taking manual control. A working manual path is worth more than a better password.
What is not known: Israel has never said who did it. The head of its cyber directorate called the attack synchronized and organized and did not name Iran; Iran appears only through unnamed officials speaking to Fox News, the Washington Post and the Financial Times. No official document says a chlorine system was altered: the alert’s stress on chlorine told defenders what to protect. The pump event is Ynet reporting, never confirmed by a named official. How the attackers got in, which sites were hit, and the cost are undisclosed.
Recommendation
Take the path away from the pump No control screen for a pump, a well or a dosing system answers from the internet. The alert’s fallback, disconnect, is the first control, not the last resort.
Replace the password with an identity A password change is an instruction, not an architecture. Remote operation runs through named, device-bound access that is off by default.
Make monitoring read one way The tank-level app and the regional dashboard receive data and cannot send a command back.
Sources: INCD SCADA alert, 23 Apr 2020; Water Authority and INCD statement (via Ynet); Ynet, 19 May 2020; Unna, CybertechLive Asia, 28 May 2020; Washington Post, 18 May 2020; Financial Times, 1 Jun 2020 (via Haaretz). Full list with links.
Soft Spots: Iran and chlorine rest on unnamed sources only; the chlorine emphasis was a defensive instruction. The pump event is Ynet, cleared for publication, unconfirmed. The exposure reading is BlastWave’s analysis.
The full record
Every claim numbered to its source. Last updated .
A government warning to protect chlorine systems, a supply that never faltered, and a poisoning plot sourced to officials who would not give their names. What is verified, what is only reported, and what is still unknown.
Summary
In April 2020 Israel's Water Authority and National Cyber Directorate said an attempted cyberattack on control and supervision systems in the water sector had been identified and handled, with no harm to supply. Israel never named the attacker. Claims that Iran tried to raise chlorine levels rest on unnamed officials, and the one reported pump event was never officially confirmed.2,3,7,9
Timeline of the 2020 attacks on Israeli water systems
Every date is tied to a source. Press reporting appears only as evidence of what was said.
The National Cyber Directorate issues an alert: reports of attempted attacks on the control systems of wastewater treatment plants, pumping stations and sewage have arrived "since the morning hours." It calls on energy and water companies to change internet access passwords to control systems immediately, reduce internet connectivity and install the latest controller versions.1
Ynet later reports that the National Cyber Directorate identified a series of incidents on these two days.2
Ynet publishes the joint Water Authority and National Cyber Directorate statement: an attempted cyberattack on control and supervision systems in the water sector was identified and handled, with no harm to supply. Water and sewage companies are told to change passwords on internet-exposed systems, with emphasis on the systems that add chlorine to wells, and to consider disconnecting where that cannot be done.3
Fox News reports that Iran was behind the attempt. No Israeli or US authority confirms it.8
The Washington Post, citing foreign intelligence sources, reports that Iran was linked to the attempted attack on at least two rural water distribution networks.5
Computers at Iran's Shahid Rajaee port, at Bandar Abbas, are disrupted, as later reported by the Washington Post.5
The Washington Post reports that US and foreign government officials say the port attack "appears to have originated with" Israel. The Israel Defense Forces decline to comment. The same story says officials familiar with the water incident described a chlorine-regulating system among the systems hackers "sought to cripple."5
Ynet reports, as cleared for publication, incidents at six facilities from north to south, including a pump in continuous operation that was taken out of automatic mode. The one named official in the article, Daniel Laker of the Water Authority, says none of the incidents caused operational damage to water supply or sewage removal.2
Yigal Unna, head of the National Cyber Directorate, calls it "a synchronized and organized attack" in a speech to CybertechLive Asia. He does not name Iran.7,11
The Financial Times, citing four Israeli officials and one Western intelligence official, all anonymous, reports the Western official's claim that the attackers tried to increase chlorine in water flowing to homes.6,9,12
The Water Authority confirms two attacks, made in the preceding weeks, on small agricultural water installations in the Upper Galilee and the center of the country, repaired on site with "no real effect." No attacker is named.4
The State Comptroller's cyber report is submitted. Citing Water Authority documents, it records attacks on the computing infrastructure of the water sector in 2020 and 2021.13
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Did Israel say an attack took place?
Yes. An attempted cyberattack on control and supervision systems in the water sector was "identified and handled"3
Verified
Was the water supply interrupted?
No. "No harm to the water supply"; it operated "without interruption"3
Verified
When was it detected?
23 April 2020, per the National Cyber Directorate's alert. Ynet dates the series to 24 and 25 April1,2
Verified
What did the government tell water companies to do?
Change passwords on internet-exposed systems, "with emphasis on operational systems and particularly chlorine-addition systems for wells," and consider disconnecting where that is not possible3
Verified
Who carried out the attack?
Israel has not attributed it. Unna: "We are not attributing or saying anything officially about who's behind it"7
Undisclosed
Was Iran behind it?
Named only by unnamed sources to Fox News, the Washington Post and the Financial Times5,8,9
Reported only
Did the attackers try to raise chlorine levels?
One unnamed Western intelligence official, in the Financial Times. No official record says a chlorine system was targeted or altered3,9
Reported only
Was any physical process affected?
One pump in continuous operation taken out of automatic mode, reported by Ynet as cleared for publication; never confirmed by a named official2
Reported only
Which sites were hit?
None named. Six (Ynet) or at least two rural networks (Washington Post)2,5
Reported only
How did the attackers get in?
Not disclosed. No investigation findings published
Undisclosed
Were there later attacks?
Two, on small agricultural installations, confirmed by the Water Authority in July 2020; "no real effect"4
Verified
Incident cost
Not published
Undisclosed
What did Israel officially say about the 2020 water attack?
That an attempted attack on water control systems was identified and handled, with no harm to supply. The joint statement of the Water Authority and the National Cyber Directorate said an attempted cyberattack on control and supervision systems in the water sector had been identified and handled.3
"There was no harm to the water supply and it operated, and continues to operate, without interruption."
The directorate's alert, dated 23 April 2020, reported attempted attacks on the control systems of wastewater treatment plants, pumping stations and sewage "since the morning hours," and called on energy and water companies to change internet access passwords to control systems immediately, reduce internet connectivity and install the latest controller versions.1 The joint instruction to water and sewage companies, as Ynet reported it on 26 April, told them to change passwords on every system exposed to the internet, with emphasis on operational systems and particularly the systems that add chlorine to wells, and, where that could not be done, to consider disconnecting from the internet.3
On 28 May 2020 the head of the directorate, Yigal Unna, called it "a synchronized and organized attack."11 Neither the statement, the alert nor Unna named the attacker, and the government has never said whether any system was actually entered.
Did Iran try to poison Israel's water with chlorine?
No Israeli official has said so on the record; the chlorine plot rests on one unnamed official. The chlorine emphasis in the official record is a defensive instruction: protect the system that adds chlorine to wells first. That tells defenders what the authorities most feared losing. It is not evidence that anyone touched a chlorine system, and the 23 April alert itself does not mention chlorine.1,3
The claim that attackers tried to increase chlorine in water flowing to homes comes from the Financial Times of 1 June 2020, which spoke to four Israeli officials and one Western intelligence official, all anonymous. Republications attribute the chlorine line to the Western official, who added:6,9,12
"It was close to successful, and it's not fully clear why it didn't succeed."
A second, narrower claim appeared on 18 May 2020, when the Washington Post wrote that officials familiar with the incident described a system that regulates the addition of chlorine and other chemicals among the systems hackers "sought to cripple." Those officials are also unnamed.5 Neither claim has been confirmed.
Unna's own chlorine sentence is a conditional about what misuse of a water system can do, not a statement of what these attackers tried. It is quoted here complete, in the version the conference organiser and Israel Defense published:
"If the bad guys had succeeded in their plot we would now be facing, in the middle of the Corona crisis, very big damage to the civilian population and a lack of water and even worse than that, when you mix chlorine or other chemicals in the wrong proportions within the water it can be harmful and disastrous."
Republications differ: the Times of Israel rendered a past-conditional variant ("could have been mixed into the water source in the wrong proportions"). No recording or official transcript of the speech has been checked.11
Who was behind the cyberattack on Israel's water systems?
Israel has never said. Unna called the attack synchronized and organized and did not name Iran.11 To CyberScoop in May 2020, he said:
"We are not attributing or saying anything officially about who's behind it."
Iran entered the story only through unnamed sources, in a dated sequence of publications that repeated one another without adding a name:
7 May 2020: Fox News names Iran. No Israeli or US authority confirmed it.8
8 May 2020: the Washington Post, citing foreign intelligence sources, links Iran to the attempted attack on at least two rural water distribution networks.5
1 June 2020: the Financial Times cites four Israeli officials and one Western intelligence official, all anonymous.6,9
An Iranian insider, also unnamed, denied it to the FT. The one named Iranian official in that coverage, Alireza Miryousefi, spokesman for Iran's mission to the United Nations, said only that Iran's cyber activities are "purely defensive and protective"; he did not specifically deny the water attack.10 Reports that the attackers routed their attempt through servers in the United States and Europe also come from unnamed officials.5,6 No government document, statement or sanction names anyone.
Did hackers take control of a pump at an Israeli water facility?
One pump event is reported, never confirmed by a named official, and the report does not say what caused it or who stopped it. On 19 May 2020 Ynet reported, as cleared for publication and without naming its source, incidents at six facilities from north to south.2 As Ynet listed them:
an unplanned change in data at one site;
at another, a pump that had entered continuous operation and was taken out of automatic mode;
a takeover of an operating system at a water corporation;
"A pump that had entered continuous operation was disconnected from automatic mode."
The Hebrew sentence is passive. It does not say who took the pump off automatic, though the people running the site are the natural reading. The one named official in the article, Daniel Laker of the Water Authority, said only that none of the incidents caused operational damage affecting water supply or sewage removal.2 It is the only process event on any record, and it is reported, not documented. No change to chemical dosing appears anywhere.
Did Israel retaliate by hacking Iran's Shahid Rajaee port?
That is unattributed reporting, held to the same standard as the water attack. On 9 May 2020 computers at Shahid Rajaee, a port at Bandar Abbas, were disrupted. On 18 May the Washington Post wrote that US and foreign government officials "say appears to have originated with" Israel. The Israel Defense Forces declined to comment.5
Mohammad Rastad of Iran's Ports and Maritime Organization said, as the Post rendered it, that the attack:
"failed to penetrate the PMO's systems and was only able to infiltrate and damage a number of private operating systems at the ports."
The retaliation story is built from the same materials as the attack story: officials without names. On this page the port is something officials told the Post appears to have come from Israel, not an Israeli operation.
What is still not known about Israeli Water
Who carried out the attack. Israel has never attributed it.7
How the attackers got in. The alert's instructions point to internet-reachable control interfaces, but that is BlastWave's reading, not a disclosed finding.1,3
Which facilities were targeted. None has been named, and the two press counts (six, and at least two) differ.2,5
Whether any control system was actually entered. The government described an attempt.3
Whether anyone touched a chlorine system. No official document says so.
What put the pump into continuous operation, and who took it out of automatic mode. Ynet's sentence is passive.2
The exact dates of the July attacks, which the Water Authority placed only in the preceding weeks.4
Unna's exact words on chlorine. Republications differ, and no recording or official transcript has been checked.11
The cost of the incidents.
Claims about Israeli Water the record does not support
Widely repeated claim
What the record says
"Iran tried to poison Israel's water."
No Israeli official has said it on the record. Israel has never attributed the attack; Iran is named only by unnamed sources in three outlets.5,7,8,9
"Iranian hackers tried to raise chlorine to dangerous levels."
The chlorine emphasis in the official record is a defensive instruction. The plot rests on one unnamed Western intelligence official in the Financial Times; a narrower Washington Post claim is also unnamed. Neither is confirmed.3,5,9
"Israel blamed Iran."
Israel's cyber chief called it synchronized and organized and did not name Iran: "We are not attributing or saying anything officially about who's behind it."7,11
"Hackers switched on a pump."
Ynet reported a pump in continuous operation taken out of automatic mode, with cause and agent unstated. No named official has confirmed it.2
"The attack disrupted Israel's water supply."
"No harm to the water supply," which operated "without interruption." No physical harm, chemical change or interruption is on any record.3
"Israel retaliated by hacking Iran's port."
Unnamed officials told the Washington Post the port attack "appears to have originated with" Israel. The Israel Defense Forces declined to comment.5
"Oldsmar was a copy of the Israeli attack."
No record links the two by actor or method. Oldsmar is the later US near miss, with its own contested record. The connection is architecture: a control screen reachable from outside, with a person as the first control to notice.
Were there more attacks on Israel's water sector?
Yes: in July 2020 the Water Authority confirmed two more, on small agricultural installations, with no real effect. The installations were in the Upper Galilee and the center of the country, and were repaired on site by the people who ran them. The Authority said they caused "no damage to the service, and had no real effect." It named no attacker and gave the timing only as the preceding weeks.4
The State Comptroller. In a chapter on the cyber protection of local water suppliers, submitted on 31 July 2022, the State Comptroller recorded, from Water Authority documents, attacks on the computing infrastructure of the water and sewage sector in 2020 and 2021.13
BlastWave analysis: the precaution read as the finding
Analysis, not a disclosed fact
The most repeated sentence about this incident is that Iran tried to poison Israel's water. The record holds something smaller and more useful: an attempted attack on control and supervision systems, handled with no harm to supply, and an instruction telling water companies to change every internet-facing password, with emphasis on the systems that add chlorine to wells.3 That emphasis was an instruction to defenders about the one system that can hurt someone. Coverage read the precaution as the finding, and an unnamed source supplied a plot to match.9
Read as a description of the exposure, the operative instructions (change passwords on systems reachable from the internet, and disconnect where you cannot) mean control screens answering from anywhere, with a password as the only question asked.1,3 That reading is BlastWave's analysis, not a disclosed fact. On the consequence ladder the official record sits on the rung of OT-adjacent access and capability development: attempted access to supervisory control, one reported and unconfirmed process event, and no physical effect. The operators deserve the last word. Somebody noticed a pump running when it should not and took it off automatic, and the water kept flowing, in April and again in July.2,4 A working manual path is worth more than a better password.
Podcast: “The Hive Entrance” (9:13). Joe Baxter and Cam Cullen on how a warning to protect the chlorine systems got read as proof they were attacked.
Video: Israeli Water Short (60 to 90 seconds).
Frequently asked questions
What happened to Israel's water systems in April 2020?
Israel's National Cyber Directorate issued an alert dated 23 April 2020 about attempted attacks on the control systems of wastewater treatment plants, pumping stations and sewage. The Water Authority and the directorate said the attempted attack on control and supervision systems had been identified and handled, and that the water supply continued without interruption. Ynet later reported incidents at six unnamed facilities on 24 and 25 April.
Did Iran try to poison Israel's water with chlorine?
No Israeli official has said so on the record. The claim that attackers tried to increase chlorine comes from one unnamed Western intelligence official quoted by the Financial Times on 1 June 2020. The official record's chlorine reference is a defensive instruction telling water companies to protect the systems that add chlorine to wells, not evidence that a chlorine system was touched.
Who was behind the 2020 cyberattack on Israel's water systems?
Israel has never attributed it. Yigal Unna, then head of the National Cyber Directorate, called it a synchronized and organized attack in May 2020 and told CyberScoop that Israel was not attributing it officially. Iran was named only by unnamed sources, in reports by Fox News on 7 May, the Washington Post on 8 May and the Financial Times on 1 June 2020.
Did hackers take control of a pump at an Israeli water facility?
Ynet reported on 19 May 2020, as cleared for publication, that at one site a pump in continuous operation was taken out of automatic mode. The report does not say what caused it or who switched it, and no named official has confirmed it. The Water Authority's Daniel Laker said none of the incidents caused operational damage to water supply or sewage removal.
Why did Israel tell water companies to protect their chlorine systems?
In April 2020 the Water Authority and the National Cyber Directorate told water and sewage companies to change passwords on internet-exposed systems, with emphasis on the systems that add chlorine to wells. Chlorine dosing is the system at a well that can hurt someone if it goes wrong, so it is the one a regulator names first. The instruction described what to protect, not what was attacked.
Did Israel hack Iran's Shahid Rajaee port in retaliation?
That has never been confirmed. The Washington Post reported on 18 May 2020 that US and foreign government officials, unnamed, said the 9 May disruption at the port appeared to have originated with Israel. The Israel Defense Forces declined to comment, and Iran's Ports and Maritime Organization said the attack damaged only some private operating systems at the ports.
Were there more cyberattacks on Israeli water facilities in 2020?
Yes. In July 2020 Israel's Water Authority confirmed two attacks on small agricultural water installations, in the Upper Galilee and the center of the country. It said they were repaired on site and had no real effect on the service, and it named no attacker. A 2022 State Comptroller report records attacks on the sector's computing infrastructure in 2020 and 2021.
Primary sources are Israeli government statements and alerts, the State Comptroller's report and the conference organiser's record of the cyber directorate head's speech. Press, including every account that names Iran or describes a chlorine plot, is cited only as evidence of what was said.
GovernmentIsrael National Cyber Directorate, alert "Attempted attacks on control and monitoring systems in the water sector," gov.il, dated 23 April 2020 (Hebrew). Read at first hand on 2 October 2026; it does not mention chlorine.
PressYnet (Ahiya Raved), report of 19 May 2020 (Hebrew; machine-assisted translation): six facilities, cleared for publication; the pump event; Daniel Laker, Israel Water Authority, on no operational damage. Cited as evidence of what was said.
GovernmentIsrael Water Authority and Israel National Cyber Directorate, joint statement and instruction to water and sewage companies, April 2020. Hebrew text as published by Ynet, 26 April 2020 (machine-assisted translation); English text as quoted by the Times of Israel, 7 May 2020. timesofisrael.com (English text)
GovernmentIsrael Water Authority, statement on two attacks on agricultural water installations, July 2020, as published by Ynet (16 July 2020, Hebrew) and Ynetnews (17 July 2020). ynetnews.com (text of statement)
PressJoby Warrick and Ellen Nakashima, "Officials: Israel linked to a disruptive cyberattack on Iranian port facility," Washington Post, 18 May 2020, read via full republication (Gulf News). Includes the Post's account of its own 8 May 2020 report and the statement of Mohammad Rastad, Ports and Maritime Organization. Cited as evidence of what was said. gulfnews.com (republication)
PressTimes of Israel, report of 1 June 2020 on the Financial Times story (sourcing; routing through American and European servers). Cited as evidence of what was said. timesofisrael.com
PressCyberScoop, report of May 2020 quoting Yigal Unna: "We are not attributing or saying anything officially about who's behind it." Cited for his on-record words. cyberscoop.com
PressFox News, report of 7 May 2020 naming Iran, as reported by the Times of Israel the same day, which noted no official confirmation from Israeli or US authorities. Fox News not read at first hand. Cited as evidence of what was said. timesofisrael.com
PressFinancial Times, report of 1 June 2020 citing four Israeli officials and one Western intelligence official, all anonymous. Paywalled; read through Haaretz, the Times of Israel and Ynet, all 1 June 2020. Cited as evidence of what was said.
PressIsrael Hayom, report of 1 June 2020 on the Financial Times story, including the remarks of Alireza Miryousefi, spokesman for Iran's mission to the United Nations. Cited as evidence of what was said. israelhayom.com
GovernmentYigal Unna, head of the Israel National Cyber Directorate, speech to CybertechLive Asia, 28 May 2020, as published by the conference organiser and by Israel Defense, "National Cyber Directorate head: Cyber winter is coming," 28 May 2020. The Times of Israel and the Associated Press rendered the chlorine sentence differently the same day. cybertechisrael.com
PressYnetnews, report of 1 June 2020 on the Financial Times story. Cited as evidence of what was said. ynetnews.com
GovernmentState Comptroller of Israel, Cyber and Information Systems report 2022, chapter on cyber protection of local water suppliers, submitted 31 July 2022, printed p. 247 (machine-assisted translation).
Cite this page
BlastWave. “Attempted Cyberattack on Israeli Water Systems (2020): What Is Verified.” Hackopedia, Volume 2, FILE 026. Last verified 2 October 2026. https://hackopedia.blastwave.com/water/israeli-water-2020/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 026 in Hackopedia Volume 2, in the Water edition.
2 Oct 2026
The National Cyber Directorate's alert was read at first hand on gov.il. The discovered date is now 23 April 2020, the alert's date; Ynet's 24 and 25 April are kept as the reported dates of the series. The page now makes clear that the alert itself does not mention chlorine; the chlorine emphasis comes from the joint Water Authority and directorate instruction as reported by Ynet.
28 Sep 2026
Hand-check at source: the Water Authority official's statement in Ynet's 19 May 2020 report (it covers sewage removal as well as supply), Unna's chlorine sentence against a same-day republication, and page 247 of the State Comptroller's 2022 report.
26 Sep 2026
Full validation pass: every figure, date and quotation traced to an Israeli government statement or alert, the outlet that first reported it, or the conference organiser's record. Added the on-record response of a named Iranian official, and made the pump event neutral as to who switched it, since the report does not say.
24 Sep 2026
Volume 2 entry built from primary sources.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
