Cyberattacks Target U.S. Water Systems as Exposed Industrial Controls Leave Critical Infrastructure Vulnerable New Jersey confirmed on Wednesday that two municipal water systems were compromised in cyberattacks involving internet-exposed industrial control systems (ICS). Operators temporarily lost remote monitoring and management capabilities, forcing a shift to manual operations. While water service remained uninterrupted and drinking water safe, the incidents exposed persistent security gaps in critical infrastructure. The attacks, investigated by the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) alongside the FBI and CISA, targeted programmable logic controllers (PLCs) devices that regulate physical processes like water pressure, chemical treatment, and pump operations. Despite New Jersey’s 2017 Water Quality Accountability Act, which mandated cybersecurity programs, incident reporting, and insurance for utilities, the compromised systems were accessible via the public internet a basic security failure. The state has not disclosed the affected utilities, leaving residents unaware of whether their water systems were breached. Investigators suspect foreign involvement, with Iran as the leading suspect, though attribution remains unconfirmed. The attacks follow a broader pattern: since July 2026, at least 12 states including Minnesota, Michigan, Wisconsin, Georgia, and New Jersey have reported similar incidents, with attackers exploiting exposed PLCs, often using default credentials. In Georgia, a July 27 water outage in Clayton County was initially dismissed as a routine pump failure before authorities linked it to unauthorized cyber activity. Nearby Columbus Water Works also detected suspicious activity the same day, prompting a switch to manual controls. In both cases, operators restored functionality, but the delayed disclosure eroded public trust. The vulnerabilities extend nationwide. Georgia Tech researchers identified over 7,000 internet-exposed industrial controllers across water systems, hospitals, airports, and military facilities, with only 30% of notified owners removing the devices. The FBI and CISA have warned of ongoing attacks targeting Rockwell Automation, Allen-Bradley, Schneider Electric, and Siemens controllers, with some incidents causing pressure loss and flooding. The U.S. water sector operates under voluntary guidelines, unlike the electric grid’s mandatory federal standards. An EPA inspector general report in 2024 found 97 water systems serving 26.6 million people with critical cybersecurity risks. Despite repeated warnings, enforcement remains lax, with utilities often lacking the resources to secure aging infrastructure. The attacks’ limited impact so far is credited to employees who recognized anomalies and operated plants manually a thin margin of safety. As remote monitoring expands to cut costs, the same access points become attack vectors. The EPA has emphasized local responsibility, but small-town water departments, often understaffed and underfunded, struggle to defend against state-sponsored cyber operations. With no federal enforcement, the risk of escalation persists. While immediate threats focus on pressure loss and operational disruptions, prolonged outages could lead to contamination. The incidents underscore a systemic failure: warnings, laws, and compliance deadlines have not translated into real-world security. The next attack may not be caught in time.