In a coordinated cyberattack campaign starting in late July 2026, Iranian-linked hackers targeted ICS devices at water and wastewater facilities across at least 12 US states. Confirmed targets include New Jersey, Alabama, Minnesota, Michigan, South Dakota, and Georgia. The attackers focused on operational technology systems, specifically ICS devices from Rockwell Automation and potentially other major vendors. Although some facilities shut down systems to mitigate risk, there have been no reported significant disruptions to water services or safety issues. The FBI confirmed at least seven states targeted as of July 30, and CISA has issued advisories urging improved OT security in the water sector.

The attacks targeted critical ICS infrastructure in the water sector but did not cause significant operational disruptions or compromise water safety. Some facilities experienced limited disruptions such as phone system outages. The campaign highlights the risk of cyber threats to critical infrastructure but, to date, has not resulted in damage or service outages. The water utilities and states involved have communicated to the public that drinking water remains safe.

No official patch or fix is applicable as this is an ongoing cyberattack campaign rather than a specific software vulnerability. CISA has urged water sector organizations to secure their operational technology environments. Facilities should review and strengthen ICS/OT security controls and incident response plans. Since no significant impact has been reported, no emergency remediation beyond standard OT security best practices is indicated at this time.