30 Water Systems Breached via Default PLC Passwords—Iran Suspected

For cybersecurity teams defending critical infrastructure, the July 2026 water sector attacks are a textbook case of how basic hygiene failings—unchanged default passwords on internet-facing PLCs—can open the door to nation-state adversaries. With 152,000 drinking water systems across the U.S., mostly operated by resource-constrained municipalities, the incident underscores the urgent need for mandatory OT security standards and stronger supply-chain accountability.

In late July 2026, a series of cyberattacks targeted the operational technology (OT) underpinning U.S. drinking water systems, exposing a persistent and dangerous industry-wide gap: default passwords on programmable logic controllers (PLCs). On July 26–27, hackers attempted to compromise at least 30 municipal water systems in Minnesota, and by early August similar intrusion attempts had surfaced in Michigan, New Jersey, and several other states. The attackers did not target traditional IT networks but directly attempted to seize control of the PLCs that manage pumps, valves, and chemical dosing—systems that are essential to delivering safe water to millions of people. The immediate defense was low-tech but effective: utilities took the affected controllers offline and switched to manual operations, preserving water safety and continuity. However, the incident underscores the fragility of critical infrastructure when basic cybersecurity hygiene is ignored.

“

drinking water systems, exposing a persistent and dangerous industry-wide gap: default passwords on programmable logic controllers (PLCs).

The method of access was startlingly simple. Many PLCs are deployed with vendor-configured default passwords and are connected directly to the internet—or reachable through gateways—without proper segmentation, firewall rules, or multi-factor authentication. A hacker scanning for internet-facing industrial devices can identify exposed controllers by IP address and attempt widely known default credentials. Because water utilities often operate with lean IT staff and rely on remote connectivity for monitoring and vendor diagnostics, the attack surface is broad. The article notes that the United States has approximately 152,000 public drinking water systems, the majority of which are small and under-resourced, creating a vast landscape of vulnerable targets.

Initial suspicion has fallen on Iran-aligned threat actors, a plausible attribution given Iran’s history of retaliatory cyber operations against U.S. critical infrastructure, including past attacks on dams and water facilities. However, as of August 5, no U.S. agency has officially confirmed attribution. The incident pattern—simultaneous probing of multiple utilities, focus on operational disruption rather than data theft, and exploitation of trivial configuration flaws—aligns with known tactics of Iranian state-sponsored groups such as APT33 (Elfin) and APT34, which have demonstrated a keen interest in industrial control systems. Regardless of attribution, the campaign illustrates how geopolitical tensions can manifest in cyberspace targeting the most mundane yet essential services.

The operational response highlights both strengths and weaknesses. By isolating compromised PLCs and resorting to manual control, utilities averted any breach of safety; the water remained potable. But such a manual override is not a scalable solution. If a large-scale, coordinated attack were to simultaneously target hundreds of systems, the ability to maintain water service would be severely tested. Moreover, the incident likely provided the attackers with valuable reconnaissance: testing defenses, confirming exposed devices, and potentially establishing persistence for future operations.