In July 2026 someone reached water utility controllers in at least seven states over the internet, changed the passwords and locked operators out. Pressure fell, plants went to hand operation, and no government has said who.
This is one of the few entries in the book on the top rung: OT command execution with corroborated physical effect, here on a government record. Look at what the commands were. No primary document shows a chemical feed changed. The FBI describes attackers changing IP addresses and passwords on internet-facing controllers. It was a lockout, and the consequence was set by what the utilities could do next.
In Plymouth, the affected sites talked over cellular, and staff watched them by hand overnight. Braham's crews had the well and plant back the same day. These operators did well. The argument, which is BlastWave's analysis and not a finding in any document, is about a path: a controller that answers anyone on the internet, through a modem that may be on nobody's drawing, trusting whoever holds a password. The spring campaign carries a government attribution. The July wave carries none.
What is not known: No government document attributes the July wave to anyone; Telegram personas claimed it, and claims are not attribution. The FBI and EPA count at least seven states and name none of them. CISA's separate count of more than 100 internet-exposed systems measures something different. How the attackers got past each controller's password is undisclosed. So is which utilities lost pressure or flooded, how many of Minnesota's more than 30 impacted systems saw service disrupted, how long Braham was down, and what any of it cost.
Recommendation
Take the path away No controller answers from the public internet, including through a cellular modem a vendor or integrator installed. Find the modems first.
Remove standing credential-based access A password on an exposed controller is what these attackers changed. Route engineering access through one gate that checks who is connecting; keep key switches in RUN.
Make read-only consumers read one way Tank levels and pressures reach the office and the phone over a path that cannot write back, so seeing the plant never requires a door into it.
Sources: AA26-097A, 7 Apr 2026, updated 22 Jul 2026; FBI/EPA I-073026-PSA, 30 Jul 2026; CISA Alert, 30 Jul 2026; Minnesota IT Services, 30 Jul 2026; City of Plymouth statement, Jul 2026. Full list with links.
Soft Spots: No government document attributes the July wave. That the path and the hand fallback decided the outcome is BlastWave's analysis. AA26-097A and CISA alert quotations were read via republication and need checking by hand.
The full record
Every claim numbered to its source. Last updated .
Controllers reached over the internet, passwords changed, operators locked out and plants run by hand, with no government attribution for the July wave. What is verified, what is only reported, and what is still unknown.
Summary
In late July 2026, someone reached internet-exposed Rockwell MicroLogix controllers at water and wastewater utilities in at least seven US states, changed their IP addresses and passwords, and locked operators out, the FBI and EPA said. Loss of pressure and flooding were reported. As of late September 2026, no government document attributes the July wave to anyone.3
Timeline of the 2026 US water PLC intrusions
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Per the later federal advisory, actors begin disrupting internet-facing PLCs in US water, energy and local government.1
Six agencies publish joint advisory AA26-097A on the spring campaign, assessing that Iranian-affiliated APT actors are responsible. EPA issues a companion release to water systems.1,10
AA26-097A is updated. Treasury joins as an author; Schneider Modicon M340 and Siemens S7-1200 models are named; the update adds one unnamed victim, observed by the FBI, whose shutdown and alarm logic was overridden.1
In Plymouth, Minnesota, two water towers and several lift stations lose communication. The affected equipment is the equipment connected over cellular, and crews run the system by hand.9
Braham's well and water treatment plant go offline and are restored the same day. Maple Plain declares a local state of emergency. The FBI later dates the reports it received from this day.3,8,11
Minnesota IT Services activates a statewide response and describes a coordinated cyberattack on more than 30 community water systems. Plymouth's connections are re-established on Tuesday afternoon.2,9,12
The FBI and EPA issue I-073026-PSA (at least seven states; "malicious cyber actors"). CISA issues an alert naming no one. Minnesota defines "impacted" and says it is not attributing the activity to a specific actor. The New York Times reports unnamed officials suspect Iran, while stopping short of concrete attribution.3,4,6,13
A Telegram persona calling itself CyberAv3ngers claims attacks on US infrastructure.7
Clayton County Water Authority in Georgia says unauthorized cyber activity "may have caused or contributed to" a disruption it is investigating.14,15
A second persona, APT IRAN, claims the Minnesota incidents.7
Separate advisory AA26-231A describes AI-generated exploitation scripts against Siemens S7 controllers. It names no actor and, as far as republications show, draws no link to the water incidents.16
Treasury sanctions individuals linked to Iran's Ministry of Intelligence and Security (SB0613). The release does not mention water, PLCs or Minnesota.17
Press outlets quote a CISA guidance page: more than 100 internet-exposed water and wastewater systems targeted in July.18
An EPA grant release refers to attacks this year on "more than 100 drinking water and wastewater systems across 12 states," naming no states and no source.19
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
IP addresses and passwords on the controllers, causing loss of monitoring and control3
Verified
Which controllers (July wave)?
Rockwell Automation/Allen-Bradley MicroLogix 1100 and 14003
Verified
Physical effects
Loss of pressure and flooding reported to the FBI; boil water notices and sustained manual operations, per CISA. No utility named3,6
Verified
Chemical dosing changed or safety system defeated at a named US utility?
Not described in any primary document. A statement about the record, not a finding that nothing happened3,6
Not on the record
Who ran the July wave?
No government attribution. Telegram personas claimed it3,4,7
Undisclosed
Who ran the spring campaign?
"Iranian-affiliated APT actors," assessed by the authoring agencies, with no confidence word1
Verified (government assessment)
Minnesota systems affected
More than 30 "impacted": confirmed malicious activity, not necessarily disrupted service4
Verified (defined term)
More than 100 systems targeted?
A CISA sentence quoted by press from a guidance page we have not read at first hand18
Reported only
How long was Braham down?
Restored the same day; accounts of the exact duration conflict8
Contested
How were the passwords obtained or bypassed?
Not disclosed for any utility
Undisclosed
Cost
Not published by any utility or agency
Undisclosed
Did Iran attack US water systems in July 2026?
No government document attributes the July 2026 wave to anyone. The FBI and EPA public service announcement of 30 July says "malicious cyber actors" and nothing more.3 CISA's alert the same day names no one.6 Minnesota said the same day:
"Minnesota is not attributing this activity to a specific actor at this time."
There is a government attribution, but it belongs to a different body of record: the spring campaign against controllers, documented in joint advisory AA26-097A of 7 April 2026 and updated on 22 July. Its attribution sentence, quoted whole, carries no confidence word:
"The authoring agencies assess a group of Iranian-affiliated APT actors is conducting this activity to cause disruptive effects within the United States."
The two share a sector, a controller maker and a season. They do not share an attribution, and the spring assessment does not travel forward to July by adjacency. What exists for July is suspicion and claims:
30 July: the New York Times reported unnamed officials who thought Iranian hackers were probably responsible; the same reporting says officials stopped short of concrete attribution.13
31 July: a Telegram persona calling itself CyberAv3ngers claimed attacks on US infrastructure. 12 August: a persona calling itself APT IRAN claimed Minnesota. Claimed by, not attributed to.7
24 August: Treasury sanctioned individuals linked to Iran's Ministry of Intelligence and Security. The release does not mention water, PLCs, Minnesota or the July wave.17
AA26-097A, in both versions, has a background paragraph on the 2023 CyberAv3ngers campaign listing names that "private industry and open sources also refer to this group as." That is the government reporting others' usage about the earlier campaign, not an identity finding about July.1
As of the last verification pass in late September 2026, we found no government document that attributes the July wave to anyone.
Did the attackers tamper with the water?
No primary document describes a chemical feed changed or a safety system defeated at a named US utility; the commands on the record were a lockout. The FBI and EPA describe the intruders changing the IP addresses and passwords on internet-facing MicroLogix controllers, so that operators lost monitoring and control. Operational effects reported to the FBI included loss of pressure and flooding.3 CISA added that the activity resulted in boil water notices and sustained manual operations.6 No utility is named in either document.
That puts this incident among the few with OT command execution and corroborated physical effect on a government record. The effect was loss of view and control with physical knock-on effects, not manipulation of treatment chemistry. The absence is a statement about what the record contains, not a finding that nothing else happened.
One override of shutdown and alarm logic is on the record, and it is not from July. The 22 July update to the spring advisory describes a single unnamed victim, observed by the FBI, whose safety logic was overridden; the 7 April version does not contain it.1 It is the ceiling of what the spring actors did once, not a fact about the July wave.
What happened to Minnesota's water systems?
More than 30 Minnesota community water systems were "impacted," four cities disclosed effects, and each of those four said its water stayed safe. Minnesota IT Services described a coordinated cyberattack on 28 July.2,12 On 30 July the state defined its word:
"In this situation, 'impacted' means investigators confirmed malicious activity involving a system's technology. It does not mean every affected community experienced a disruption to water service."
"The nature and extent of the impact varied by system, and the investigation is still determining how many experienced operational disruptions."
Braham. City officials said "the attackers shut down the operating controls, which shut down the well and water treatment plant" on Monday 27 July, and that "this attack did not alter or cause any issue to the physical water plant or water quality or safety." The plant was restored later that day. Accounts of the exact duration conflict, so we state only that it came back the same day.5,8
Plymouth. The city said the outages were on "equipment connected via cellular communications within the system," that crews kept operating through manual procedures, and that "water levels and water quality are unaffected." Connections were re-established on the Tuesday afternoon.9 The city's public works director told Governing: "Other sites that connect via fiber or different methods were uninterrupted." The city's own statement confirms the cellular half of that observation, not the fiber half.20
Maple Plain and South St. Paul. Maple Plain declared a local state of emergency on 27 July after "certain automated control functions" were affected.11 South St. Paul reported losing some automated controls and kept running.5
How many water systems were hit?
There is no single count: each figure measures something different, and none of them sizes another.
At least seven states: utilities that reported incidents to the FBI since 27 July 2026. The states are not named.3
More than 100 internet-exposed systems targeted across July: a CISA sentence quoted by press from 26 August, tied to CISA's Internet Exposure Reduction Guidance page. It is not in the 30 July alert as republished, and we have not been able to read the page at first hand or date it.6,18
Twelve states: began as an ABC News tally, and was later repeated, without naming the states or a source, in EPA's 31 August grant release: "more than 100 drinking water and wastewater systems across 12 states." It is still not the FBI's count.19,21
More than 30 in Minnesota: systems "impacted" in the state's defined sense, not systems whose service was disrupted.4
Adding these, or using one to size another, produces a number nobody measured.
Was Clayton County, Georgia, part of the campaign?
Not confirmed: the utility itself says only that cyber activity "may have caused or contributed to" its disruption. Clayton County Water Authority said on 3 August 2026 that it was investigating unauthorized cyber activity that "may have caused or contributed to" the disruption, and that the investigation remained ongoing.14 Its spokeswoman had earlier said, "we can't confirm that somebody hacked into it."15 No later confirmation was found through late September 2026, so this entry does not list Clayton County as a confirmed victim.
Were AI-written exploits used against the water utilities?
Nothing in the July wave documents says so. AI-assisted exploit development appears in press accounts of the water incidents. A separate advisory, AA26-231A of 19 August 2026, describes AI-generated exploitation scripts against Siemens S7 controllers. It concerns different controllers, names no actor and, as far as republications show, draws no link to the water incidents.16 Adjacent is not attributed.
What is still not known about US Water Campaign
Who carried out the July wave. No government document attributes it; Telegram claims are not attribution.3,4
Which states the FBI's count of at least seven covers.3
How the intruders got past each controller's password.
Which utilities lost pressure, flooded or issued boil water notices.3,6
How many of Minnesota's more than 30 impacted systems saw service disrupted.4,12
How long Braham's well and treatment plant were down.8
The source document and date of CISA's more than 100 systems figure.18
Whether Clayton County's disruption was caused by the cyber activity.14
What any of it cost.
Claims about US Water Campaign the record does not support
Widely repeated claim
What the record says
"Iran attacked US water systems in July 2026."
No government document attributes the July wave. The FBI and EPA say "malicious cyber actors"; Minnesota is "not attributing this activity to a specific actor." The Iranian-affiliated assessment belongs to the spring campaign.1,3,4
"CyberAv3ngers claimed it, so it was CyberAv3ngers."
Telegram posts by personas are claims, not attribution. No government has confirmed them.3,7
"Hackers poisoned the water" or "tampered with treatment chemicals."
No primary document describes chemical dosing manipulation or safety system defeat at a named US utility. The commands on the record were a lockout.3,6
"100+ water providers across 12 states were hacked."
A fusion of two measurements. CISA's figure is internet-exposed systems targeted in July; twelve states began as a news tally. The FBI's count is at least seven states.3,18,19,21
"More than 30 Minnesota towns lost water service."
"Impacted" means investigators confirmed malicious activity on a system's technology, not that every community lost service.4
"The attackers used AI-written exploits."
AA26-231A describes AI-generated scripts against Siemens S7 controllers, names no actor and, as far as republications show, draws no link to the water wave.16
"Braham was down for under two hours" (or "more than an hour").
Accounts conflict. The well and plant were restored the same day.8
"Clayton County, Georgia, was hacked in the campaign."
The utility says cyber activity "may have caused or contributed to" its disruption; the investigation was ongoing.14
BlastWave analysis: a lockout, decided by the path and the fallback
Analysis, not a disclosed fact
This is one of the few entries in the Hackopedia on the top rung: OT command execution with corroborated physical effect, here on a government record. Look at what the commands were. The FBI describes intruders changing IP addresses and passwords on internet-facing controllers, and operators losing monitoring and control.3 It was a lockout, and the consequence was set by what the utilities could do next. In Plymouth, staff watched the cellular-connected sites by hand overnight; Braham's crews had the well and plant back the same day.8,9 These operators did well.
The argument, which is BlastWave's analysis and not a finding in any document, is about a path: a controller that answers anyone on the internet, through a modem that may be on nobody's drawing, trusting whoever holds a password. The fallback held wherever a person could drive to the tower. Build that path before you need it, and take the other one away. And on attribution, the spring campaign carries a government assessment; the July wave carries none.
Podcast: “The Lake Cabin Keypad” (9:21). Joe Baxter and Cam Cullen on why a lockout became a story about pressure and paperwork rather than water, and why the July wave carries no name.
Video: US Water Campaign Short (60 to 90 seconds).
Frequently asked questions
What happened to US water systems in July 2026?
The FBI and EPA said on 30 July 2026 that since 27 July, water and wastewater utilities in at least seven states had reported incidents in which intruders reached internet-facing Rockwell MicroLogix controllers, changed their IP addresses and passwords, and cut operators off from monitoring and control. Reported effects included loss of pressure and flooding. CISA said the activity led to boil water notices and sustained manual operations.
Did Iran hack US water systems in 2026?
As of late September 2026, no government document attributes the July 2026 wave to anyone. The FBI and EPA announcement says only "malicious cyber actors," and Minnesota said on 30 July that it was not attributing the activity to a specific actor. A separate joint advisory of 7 April 2026 assessed that Iranian-affiliated APT actors were behind an earlier spring campaign against controllers. That assessment belongs to the spring campaign, not to July.
Was the drinking water poisoned or contaminated?
No primary document describes chemical dosing manipulation or a safety system defeat at a named US utility. The commands on the record were a lockout: passwords and IP addresses changed. The four Minnesota cities that disclosed incidents, Braham, Plymouth, South St. Paul and Maple Plain, said their water stayed safe. This is a statement about what the record contains, not a finding that nothing else happened.
How many water systems were affected by the 2026 cyberattacks?
There is no single count. The FBI and EPA said at least seven states, unnamed. Minnesota IT Services said more than 30 community water systems were impacted, meaning confirmed malicious activity, not necessarily disrupted service. Press quoted a CISA page saying more than 100 internet-exposed systems were targeted in July, and an EPA release of 31 August referred to 12 states. These measure different things and should not be combined.
What happened in Braham and Plymouth, Minnesota?
Braham city officials said attackers shut down the operating controls on Monday 27 July 2026, taking the well and water treatment plant offline; the plant was restored the same day. Plymouth said equipment connected over cellular lost communication from late 26 July, crews ran the system by hand, water levels and quality were unaffected, and connections were re-established on the Tuesday afternoon.
Who claimed responsibility for the attacks on US water utilities?
Telegram personas made claims: one calling itself CyberAv3ngers posted on 31 July 2026 that it had attacked US infrastructure, and one calling itself APT IRAN claimed the Minnesota incidents on 12 August. These are claims, not attribution. As of late September 2026, no government document attributed the July wave to any actor.
How did the attackers get into the water utility controllers?
The FBI and EPA said the targeted controllers were reachable from the internet, and CISA said this was commonly through cellular modems installed by operators, vendors or system integrators that may not be documented. The FBI noted that similar setups provided by third parties may let one technique succeed many times. How the intruders got past each controller's password has not been disclosed.
Primary sources are the federal advisories and announcements, Minnesota's state statements, and the affected cities' and utilities' own statements. Press is cited only as evidence of what was said or claimed.
FederalFBI, CISA, NSA, EPA, DOE, USCYBERCOM Cyber National Mission Force and (from 22 July) the Department of the Treasury, Joint Cybersecurity Advisory AA26-097A, "Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure," 7 April 2026, updated 22 July 2026. Read from the FBI's IC3 copies. PDF (22 July version) · 7 April version (PDF)
GovernmentMinnesota IT Services, "MNIT activates statewide cybersecurity response," 28 July 2026. mn.gov
FederalFBI and EPA, Public Service Announcement I-073026-PSA, "Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions," 30 July 2026 (fbi.gov page last modified 6 August 2026). PDF
GovernmentMinnesota IT Services, "Minnesota continues response to cyber activity affecting community water systems," 30 July 2026. mn.gov
PressCity of Braham, City of Plymouth, City of South St. Paul and City of Maple Plain statements, 27 to 28 July 2026, as reported by CBS Minnesota and the Minnesota Star Tribune. Cited as evidence of what was said.
FederalCISA, EPA and FBI, Alert, "CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs," 30 July 2026. Read via same-day republication. CISA bulletin · republication (Water Online)
PressCybersecurity Dive, 31 July and 20 August 2026 (the second citing Check Point on the APT IRAN persona's claim). Cited as evidence of what was claimed.
PressMPR News, "Officials in Minnesota cities say cyberattacks targeted water systems," 27 July 2026, quoting City of Braham officials. Cited as evidence of what was said. mprnews.org
GovernmentCity of Plymouth, Minnesota, "Communications restored at Plymouth water facilities," July 2026. plymouthmn.gov
FederalUS Environmental Protection Agency, "EPA, FBI, CISA, NSA Issue Joint Cybersecurity Advisory to Water System Regarding Iranian-Affiliated Cyber Attacks," news release, 7 April 2026. epa.gov
GovernmentCity of Maple Plain, Minnesota, press release on a cyber security incident, 27 July 2026. mapleplainmn.gov
PressThe Hacker News, 29 July 2026, quoting Minnesota IT Services statements of 28 and 29 July 2026. Cited as evidence of what was said. thehackernews.com
PressThe New York Times, 30 July 2026, reporting unnamed officials; known to us through quotation in other coverage, not read at first hand. Cited only as evidence of what was said.
GovernmentClayton County Water Authority, Georgia, advisory of 3 August 2026. ccwa.us
PressAtlanta News First, "Clayton County boil water advisory possibly related to cyberattack," 4 August 2026, with news-daily.com, 3 August 2026, reporting Clayton County Water Authority statements. Cited as evidence of what was said. atlantanewsfirst.com
FederalNSA, CISA, FBI, DOE and EPA, Joint Cybersecurity Advisory AA26-231A, "Defending Against an Active Threat to Siemens S7 Series PLCs," 19 August 2026 (some coverage gives 20 August). Cited only for what it does not say about the water incidents.
FederalUS Department of the Treasury, press release SB0613, 24 August 2026 (sanctions on individuals linked to Iran's Ministry of Intelligence and Security). Cited only for what it does not say. treasury.gov
PressSecurityWeek, "CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks," 26 August 2026, quoting CISA's Internet Exposure Reduction Guidance page; also TechCrunch (26 August) and Industrial Cyber (27 August). Cited as evidence of what was said. securityweek.com
FederalUS Environmental Protection Agency, "EPA Announces $11.75 Million to Help Protect Drinking Water from Cyberattacks and Extreme Weather Events," news release, 31 August 2026. epa.gov
PressJule Pattison-Gordon, "Troubled Waters: Minnesota Cities Weather Cyber Attack," Governing, 31 July 2026, reporting Plymouth's public works director. Cited as evidence of what was said. governing.com
PressABC News, 31 July 2026 (the twelve-state tally, and quotations of Minnesota IT Services and the CISA alert). Cited as evidence of what was said.
Cite this page
BlastWave. “US Water Utility PLC Intrusions (2026): What Is Verified.” Hackopedia, Volume 2, FILE 024. Last verified 28 September 2026. https://hackopedia.blastwave.com/water/us-water-campaign-2026/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 024 in Hackopedia Volume 2, in the Water edition.
28 Sep 2026
Hand-check of primary documents: re-read the 7 April 2026 version of AA26-097A and corrected which controller models the 22 July update added (the Siemens S7 was already flagged as possibly targeted in April); confirmed Minnesota's non-attribution statement word for word.
26 Sep 2026
Full validation of every claim against primary sources. Corrected the Plymouth official's title, dated AA26-231A to 19 August, recorded that an EPA page now carries the twelve-state figure, narrowed the water-safe statement to the four cities that disclosed, and confirmed the spring safety-logic case appears only in the 22 July update.
24 Sep 2026
Volume 2 entry built from primary sources: the federal advisories, Minnesota's state statements and the affected cities' own statements.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
