--- title: Attackers Locked Water Utilities Out of Their Own Equipment in at Least Seven States description: The FBI and EPA say attackers changed passwords on internet-facing controllers at water utilities in at least seven states, with effects including pressure loss and flooding. author: Dr Marina Nani (Editor-in-Chief) updated: 2026-08-05T09:28:33.702Z canonical: https://richhealthmagazine.com/article/water-utilities-cyber-attacks-seven-states-fbi-epa categories: Everyday Wellness content_type: News region: United States publication: Rich Health Magazine schema_type: Article --- Since July 27, water and wastewater utilities in at least seven states have told the FBI that outside actors broke into the small industrial computers that open valves and run pumps, and in some cases the intrusions disrupted how the utility operated its own equipment. The [FBI and EPA issued a joint public warning](https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions) about the activity on July 30, and the American Water Works Association, the industry's main professional group, followed with its own statement on August 4. ## Attackers Reached Water Equipment Through the Internet The FBI and EPA say the intrusions targeted programmable logic controllers, the small industrial computers that open valves, run pumps and monitor equipment at water and wastewater plants. The devices involved were specific models made by Rockwell Automation under the Allen-Bradley brand, the MicroLogix 1100 and 1400 series, though the agencies say similar risks apply to other manufacturers' equipment. After getting into internet-connected controllers, the attackers changed IP addresses and passwords, which cut off the utility's own staff from monitoring or controlling the equipment. At least one utility found its controller programming had been altered after staff noticed inconsistencies in the logic across several of its sites. Several affected utilities shared similar network setups installed by outside vendors, which the FBI says may have let the same technique work against more than one customer. ## Some Utilities Lost Pressure or Had Flooding The operational effects reported to the FBI have included loss of water pressure and flooding. How badly any one utility was affected depended on what the controller was actually doing, monitoring equipment or directly controlling it, which model was involved, and whether staff could switch over to running the system by hand. The warning states that a loss of pressure could potentially allow untreated ground water to seep into pipes. The agencies frame that as a possible consequence of pressure loss, and neither the FBI nor the EPA has said that any utility's treated drinking water was contaminated. Both agencies say they are continuing to work directly with the affected utilities. ## The Industry Is Pressing for National Cybersecurity Rules The American Water Works Association put out its own statement on August 4, in which its chief executive, David LaFrance, called on the sector to stay alert to changing threats. The association, a nonprofit founded in 1881 with roughly 50,000 members, said utilities need better access to timely threat intelligence, technical expertise, ongoing training and the funding to secure their systems. > "The recent cyber attacks on multiple U.S. water systems underscore the importance of remaining vigilant against evolving cyber threats." > — David LaFrance, CEO, American Water Works Association The association is pressing for nationwide minimum cybersecurity requirements for water utilities, developed with input from water professionals and cybersecurity experts, while cautioning that utilities differ so widely in size and complexity that a single fixed standard may not fit all of them. ## Utilities Are Being Told to Take Controllers Off the Open Internet The FBI is telling utilities to disconnect controllers from the open internet, route any remote access through a secure gateway, lock down cellular modems and passwords, restrict which devices can talk to a controller, and keep the ability to run their systems manually if the digital controls fail. Whether a given utility has done these things is a fair question to put to it. Water systems are also required to publish an annual water quality report, one of the checks covered in [our guide to what you can find out about your own tap water](https://richhealthmagazine.com/article/is-your-tap-water-safe-a-reality-checklist-for-busy-women). ## FAQ **Q: What is a programmable logic controller?** It is a small industrial computer that water and wastewater plants use to open and close valves, run pumps, and monitor equipment. It is the device the FBI and EPA say the attackers targeted. **Q: Did the attacks contaminate anyone's drinking water?** The FBI and EPA have not said that. They report operational effects such as loss of pressure and flooding, and they note that a loss of pressure could potentially let untreated ground water seep into pipes, but that is described as a possible consequence, not a confirmed event. **Q: Which states or utilities were affected?** The warning says utilities in at least seven states have reported incidents since July 27, but it does not name the states or the specific utilities involved. **Q: What are utilities being told to do about it?** The FBI recommends taking controllers off the open internet, securing remote access and passwords, limiting which devices can connect to a controller, checking equipment logs and programming for unauthorized changes, and keeping the ability to switch to manual operation.