CISA says more than 100 US water systems were targeted by hackers last month, in warnings tied to suspected Iran-backed activity.
The Cybersecurity and Infrastructure Security Agency confirmed this week that suspected attackers went after upwards of 100 water utilities across the country during July. The agency's warning arrives as officials track a broader pattern of cyberattacks against critical water infrastructure that they believe is linked to Iran-backed actors. CISA has not detailed how many of the targeted systems were actually breached versus merely probed, nor has it named specific victims or techniques. The agency's language stops short of formally attributing the campaign to any government.
Water utilities are a favorite target for state-linked hackers precisely because so many run outdated industrial control systems with weak segmentation from the internet. A wave of probing at this scale, even without confirmed breaches, suggests attackers are mapping exposure across the sector rather than hitting a single target. That's the kind of reconnaissance that tends to precede more disruptive action, not follow it.
CISA's own hedging - "suspected," not "confirmed" - is the most honest part of this warning, and a reminder that attribution in these campaigns is usually slower and murkier than the headlines suggest.