Water system cyberattacks: the threat to critical infrastructure and what it means

01How water systems are being attacked

Water supply is the provision of water by public utilities, commercial organisations, municipal or national governments, and other entities. In the United States alone, there are roughly fifty thousand community water systems serving everything from a few dozen people to millions. The vast majority are small systems with limited budgets and minimal cybersecurity staff, if any. That scale and fragmentation makes them an attractive target for attackers seeking disruption.

The attacks have taken several forms. In some cases, threat actors gained access to operational technology networks and manipulated control systems that manage water treatment chemicals. In others, ransomware shut down billing and customer service platforms without directly affecting treatment. The most serious incidents involved attempts to alter chemical dosing levels, potentially endangering public health if not caught quickly.

What makes these attacks concerning is not just their frequency but their accessibility. Many water systems use remote access tools that were deployed for convenience without robust authentication. Default passwords, unpatched software, and internet-connected control panels provide multiple entry points that require little sophistication to exploit.

02Why water infrastructure is vulnerable

Critical infrastructure, or critical national infrastructure, describes assets, systems, and networks that are essential for the functioning of a society and economy. Water and wastewater systems fall squarely within this definition. Yet unlike the electricity grid or financial sector, which have invested heavily in cybersecurity over the past decade, many water utilities have lagged behind.

The reasons are structural. Most water systems in the United States are municipally owned and operated with ratepayer-funded budgets. Cybersecurity competes with aging pipe replacement, treatment upgrades, and compliance mandates for limited capital. A utility serving five thousand customers may have a single IT person who also handles operational technology, with no dedicated security role at all.

The result is a sector with enormous surface area and minimal defense. Supervisory control and data acquisition systems, which manage pumps, valves, and chemical dosing, were designed for reliability and ease of operation, not security. Many were installed decades ago and have been incrementally connected to business networks and the internet without the segmentation that would limit an attacker ability to reach operational controls.

03The attack methods being used

The attack methods targeting water systems span both information technology and operational technology domains. On the IT side, phishing emails and credential theft remain the most common initial access vectors. Once inside a business network, attackers move laterally seeking connections to operational networks, often finding them because segmentation is weak or nonexistent.

Supervisory control and data acquisition systems are particularly exposed. SCADA is a control system architecture that uses computers, networked data communications, and graphical user interfaces for high-level process supervisory management. When these systems are accessible from the business network or the internet, attackers can send commands to physical equipment. In one documented case, an attacker remotely increased the sodium hydroxide setting at a Florida water treatment plant by a factor of more than one hundred, a change that would have made the water dangerously caustic if an operator had not noticed.

Ransomware has also hit the water sector hard. Attackers encrypt business systems, disrupting billing, customer service, and reporting. While treatment often continues on manual controls, the financial and operational impact can be severe. Some utilities have paid ransoms; others have spent weeks recovering from backups.

04What a successful attack could do

A successful attack on a water system could have consequences ranging from service disruption to public health emergencies. At the operational level, attackers could shut down pumps, open or close valves, or alter chemical dosing. If chemical levels are manipulated undetected, the water reaching homes could fail to meet safety standards or, in extreme cases, become directly harmful.

Beyond the immediate physical risk, the cascading effects of a water system outage are enormous. Hospitals, food processing, manufacturing, and fire suppression all depend on water. A multi-day outage in a major metropolitan area would strain every layer of emergency response. The economic cost alone could reach hundreds of millions of dollars per day.

The psychological impact is also significant. Water is one of the most basic expectations of modern life. The knowledge that a remote attacker could affect what comes out of the tap erodes public trust in a way that is difficult to rebuild. Even unsuccessful attacks that are detected and publicized can reduce confidence in municipal services.

05How municipalities are responding

Many water utilities are now taking steps to improve their cybersecurity posture. The responses vary widely based on resources and expertise. Larger systems with dedicated IT and security teams have been able to implement network segmentation, multi-factor authentication, and continuous monitoring. Smaller systems often rely on state and federal assistance to fund basic improvements.

Some utilities have disconnected their operational technology networks from the internet entirely, reverting to manual monitoring or air-gapped control systems. While effective against remote attacks, this approach can reduce operational efficiency and is not always feasible for systems that depend on remote sites and automated controls spread across large geographic areas.

Information sharing has improved. Water sector organizations like the Water Information Sharing and Analysis Center provide threat intelligence and incident response coordination. Utilities that participate can receive alerts about active threats and recommendations for mitigation, though participation rates remain uneven across the sector.

06The federal government role

The federal government has elevated water system cybersecurity as a national priority. The Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency have issued joint guidance urging water systems to conduct risk assessments, implement basic cyber hygiene, and report incidents. Some of this guidance has been paired with enforcement mechanisms, though the regulatory framework remains incomplete.

Funding has been a challenge. While federal grants and programs exist to support water infrastructure, the portion dedicated specifically to cybersecurity is small relative to the need. The cost of upgrading systems nationwide has been estimated in the billions, far exceeding available assistance. This gap means many utilities must prioritize which improvements to make first.

Legislation has been proposed to establish baseline cybersecurity requirements for water systems, similar to those that exist for the electricity sector. Such requirements would mandate risk assessments, incident reporting, and minimum security controls. The debate over whether to mandate or merely encourage these measures reflects a broader tension between federal oversight and local control of water systems.

07What securing water systems requires

Securing water systems requires a layered approach that addresses both technical and organizational gaps. At the technical level, the priority is network segmentation: separating business networks from operational technology networks so that a compromise of one does not provide access to the other. Multi-factor authentication for all remote access, patching of known vulnerabilities, and continuous monitoring are baseline requirements.

At the organizational level, water systems need dedicated cybersecurity expertise, which many small utilities cannot afford on their own. Regional partnerships and shared services models, where multiple utilities pool resources to fund a shared security operations center, are one approach. Another is leveraging state-level programs that provide security assessments and remediation support to small systems.

The challenge is ultimately one of priorities and funding. Water systems compete with every other infrastructure need for limited budgets. Without sustained investment and a regulatory floor that requires minimum security standards, the gap between the threat and the defense will continue to widen. The spread of attacks to at least twelve states makes clear that the status quo is not sustainable.