At Least 12 States Report Water System Cyberattacks

Cyberattacks that may be linked to Iran-backed hackers have been reported at water systems in at least a dozen states, sources familiar with the matter told CBS News on Wednesday.

The affected states include Michigan, Minnesota, Georgia, New Jersey and South Dakota. In Minnesota, more than 30 community water systems were affected, CBS News previously reported.

In Georgia, the Clayton County Water Authority, which serves 300,000 customers in the Atlanta area, said cyber activity last month caused a drop in water pressure and forced the agency to issue a boil water advisory. Service was restored within hours.

Some utilities have lost critical remote-control capabilities, forcing operators to switch to manual mode. In several cases, the hackers gained remote access to pumps, valves and water pressure.

So far, according to officials, the attacks have had no impact on drinking water, which has remained safe.

On July 30, the FBI, the Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency warned that cyber threat actors had remotely accessed online infrastructure for water and wastewater systems in at least seven states, "resulting in a loss of monitoring and control functionality."

Water agencies were advised to disconnect their operating programs from the internet and to strengthen password protections and firewalls.

Federal investigators have not made any formal attribution for the intrusions. The tactics resemble a 2023 campaign by the CyberAv3ngers, a group linked to the Iranian Revolutionary Guard, which tapped into water-system controllers that were still using default passwords.