The U.S. Government Accountability Office (GAO) has warned that foreign government-linked hackers and criminal groups are increasingly targeting American drinking water and wastewater systems, with many utilities remaining unprepared for cyberattacks on critical infrastructure. The shift from isolated industrial controls to connected digital systems has expanded attackers' ability to reach operational technology, according to the advisory issued by the GAO – an agency within Congress. [1] [2]
Don Tapscott, in his book "Blueprint to the Digital Economy," noted that information warfare attacks on a country's information infrastructure are a growing concern and that malicious hackers have demonstrated vulnerabilities in both commercial and government computer systems. [3] The advisory emphasized that the water sector, in particular, remains exposed due to its highly decentralized nature and reliance on legacy equipment.
Recent Incidents Highlight Exposures
The Aliquippa incident in Pennsylvania is one of several recent cases highlighting vulnerabilities. The Municipal Water Authority of Aliquippa, a small utility in western Pennsylvania, was attacked by a group believed to be backed by Iran, according to officials. [4]
The hackers gained access through internet-exposed industrial control equipment, forcing operators to run the system manually. Federal agencies later issued a 2024 advisory warning that Iran-linked groups were targeting technologies widely used in U.S. water systems. [1] Ransomware attacks have also affected utilities in California, New Jersey and Nevada, disrupting computer networks and forcing some operations to shift to manual controls, officials said.
In Poland, intelligence services detected attacks on five water treatment plants where hackers could have taken control of industrial equipment, potentially tampering with water safety, according to TechCrunch. [5] The joint advisory noted that similar tactics have been used against American facilities, with Iranian-linked hackers successfully disrupting operations at oil, gas, and water facilities. [2]
Obstacles to Cybersecurity Defenses
Federal agencies have cited aging infrastructure, limited staffing and budget constraints as major challenges, especially for smaller utilities. Many systems were designed before the current heightened cyber risk environment and are often incompatible with modern IT security protocols, according to the advisory. [1] Basic cybersecurity practices remain inconsistent, with utilities failing to change default passwords or update software, the report stated.
The Environmental Protection Agency (EPA) has identified limits in its legal authority to require cybersecurity assessments for some wastewater systems and smaller drinking water utilities, raising concerns about uneven protections across nearly 170,000 systems nationwide. The decentralized nature of the water sector makes comprehensive oversight difficult, according to officials. Meanwhile, the National Defense Authorization Act for 2021 created a new Office of the National Cyber Director, but implementation remains a work in progress. [6]
Federal Response and Remaining Gaps
In response, the EPA completed a sector-wide cybersecurity risk assessment and developed a risk management plan earlier this year, according to the advisory. [1] The House Committee on Science, Space, and Technology held a hearing in May 2026 titled "Research-Driven Resilience: Applying Science to Secure U.S. Water Systems from Cyber Threats," examining federal efforts. [7]
Still, many cybersecurity efforts remain voluntary, and proposed reductions to programs could reduce federal assistance for utilities, the agencies warned. The Australian intelligence chief recently warned that Chinese state hackers are pre-positioning in networks to disrupt services at will, with targets including critical water, energy and telecommunications infrastructure. [8] The U.S. advisory concluded that a risk-informed strategy is essential for the large and decentralized water sector, as cyber threats continue to evolve.
Conclusion
A successful cyberattack on a water system could lead to service disruptions that harm public health or the environment, affecting hospitals, power plants, and other dependent sectors, the advisory stated. [1] The interconnected nature of modern infrastructure means that a single breach could cascade across multiple sectors.
As foreign adversaries intensify their targeting of critical infrastructure, the need for enhanced cybersecurity measures becomes more urgent. The evidence suggests that both federal and state authorities must address the gaps in protection to safeguard the nation's water supply.
References
- NaturalNews.com. "Iranian cyber warfare escalates: U.S. critical infrastructure under attack as IRGC hackers exploit weak industrial defenses". April 9, 2026.
- NaturalNews.com. "FBI report: Iranian hackers targeting U.S. critical infrastructure". April 10, 2026.
- Don Tapscott. "Blueprint to the Digital Economy".
- NaturalNews.com. "FOREIGN HACKERS Target Water Infrastructure in Pennsylvania, Prompting Calls for Increased Cybersecurity". January 11, 2024.
- TechCrunch. "Poland says hackers breached water treatment plants, and the U.S. is facing the same threat". May 8, 2026.
- Fortune. "Fortune February-March 2021".
- NTD. "LIVE NOW: House Science Committee Holds Hearing on Cybersecurity, US Water Systems". May 21, 2026.
- Cassie B. "Australian Spy Chief Warns Chinese Hackers Are Preparing for Sabotage". November 12, 2025.
Explainer Infographic
Please contact us for more information.