Story perspectives

FBI Investigates Iran-Linked Tactics in Seven-State Water System Hacks

8/8/2026

Summary

FBI probes water

FBI opened investigation after hackers attacked municipal water systems in seven states.
On July 27, Cape May and Woodbine water departments detected a cyber intrusion that blocked remote access.
Hackers changed IP addresses and passwords on PLCs, halting remote monitoring while pump operations continued.
FBI assistant director Brett Leatherman said the tactics resembled Iran-linked attacks, urged utilities to disconnect control devices from the internet, and noted water service stayed uninterrupted.

Summary

Water sector vulnerable

Recent cyber attacks on U.S. water facilities exposed critical security gaps.
Only about 420 of roughly 151,000 water facilities voluntarily share cybersecurity information.
Many programmable logic controllers operate without passwords or with default credentials, creating low-hanging-fruit targets.
The administration has proposed $707 million in cuts to the Cybersecurity and Infrastructure Security Agency, which defends water-system networks.
The Operational Technology Cybersecurity Coalition urged Congress to enact stronger safeguards after the attacks.

History

Historical Context

The December 23 2015 hack of Ukraine’s power grid—where the Russian Sandworm group used BlackEnergy malware to plunge about 230,000 customers into darkness—marked the first confirmed cyberattack on an electricity network amid the Russo-Ukrainian War. That precedent informs today’s 2024 FBI-flagged intrusion on New Jersey’s Cape May and Woodbine water systems, prompting calls for stronger credential controls and federal funding.

1 of 3

FBI probes water

FBI opened investigation after hackers attacked municipal water systems in seven states.
On July 27, Cape May and Woodbine water departments detected a cyber intrusion that blocked remote access.
Hackers changed IP addresses and passwords on PLCs, halting remote monitoring while pump operations continued.
FBI assistant director Brett Leatherman said the tactics resembled Iran-linked attacks, urged utilities to disconnect control devices from the internet, and noted water service stayed uninterrupted.

1 / 3