Five Critical Steps to Secure America’s Water Systems After Iranian Cyberattack

Iranian-linked hackers breached more than 30 community water systems across Minnesota in late July, marking an escalation in cyber threats targeting America’s essential infrastructure. Similar intrusions were detected in several other states, prompting national concern about the vulnerability of systems millions of Americans depend on daily.

The attacks revealed a troubling reality: the breach required minimal technical sophistication. Hackers exploited fundamental security weaknesses that federal agencies have publicly documented for years, rather than deploying advanced cyber weapons or zero-day exploits previously unknown to officials.

A 2024 Environmental Protection Agency review of 1,062 drinking-water systems serving more than 193 million citizens identified critical or high-risk vulnerabilities at 97 systems serving approximately 26.6 million Americans. An additional 211 systems serving more than 82.7 million people maintained network portals visible from the public internet, creating direct entry points for hostile actors.

What distinguishes water infrastructure attacks from typical data breaches is their potential for catastrophic physical consequences. Compromised systems could halt pump operations, interrupt water supplies and endanger entire communities’ health and safety—not merely expose personal information.

The challenge spans the entire water sector, which comprises nearly 170,000 systems nationwide. Many operate legacy equipment, face personnel shortages and lack dedicated cybersecurity staff. Artificial intelligence further complicates defenses by enabling attackers to identify vulnerabilities, craft sophisticated phishing campaigns and rapidly modify malware at unprecedented scale.

Five essential actions can substantially fortify water systems against compromise. First, utilities must maintain complete inventories of all networked equipment, software sources, remote-access points and third-party vendors. Second, every network access point requires hardened security through eliminating default passwords, implementing multi-factor authentication and isolating critical controls from internet exposure.

Third, operational technology controlling pumps and infrastructure must operate on separate networks entirely from administrative systems used for email and internet browsing. Fourth, software updates must be deployed routinely and promptly, as attackers frequently exploit known vulnerabilities whose patches existed months or years prior.

Finally, critical infrastructure should deploy application allowlisting—a system permitting only pre-approved software to execute while blocking all other programs by default. This proactive approach proves more effective against rapidly evolving AI-generated malware than traditional threat-detection systems.

Utility operators, municipal leaders and federal agencies must immediately assess compliance with these standards, assign clear accountability for remedying deficiencies and establish firm deadlines for corrections. Where communities lack expertise or resources, state and federal partners must provide assistance.

Minnesota’s water systems continued operating despite the attack, but this outcome demands urgency rather than reassurance. America’s adversaries actively exploit known vulnerabilities, and delaying corrective action virtually guarantees more serious future attacks potentially threatening American lives.