The War Reaches the Water Plant: US Warns Iran-Linked Hackers Are Tampering With Utilities
A joint US advisory now says Iranian-affiliated actors are inside internet-exposed controllers at American water and energy utilities — and has widened the named target hardware from one vendor to three.
On July 22 CISA, the FBI, NSA and Department of Energy updated advisory AA26-097A to warn that Iran-affiliated actors are breaking into internet-exposed industrial controllers at US water, wastewater and energy utilities and tampering with them — expanding the named victim hardware from Rockwell to Siemens and Schneider Electric. The attackers use the vendors' own engineering software — Rockwell Studio 5000, Schneider EcoStruxure, Siemens TIA Portal — to reach programmable logic controllers directly over the internet, alter project files, and feed operators false readings to blind them. The agencies cite operational disruption and financial losses, and frame it as fallout from the 2026 US–Israel–Iran war. Separately, fact-checkers logged a surge of AI-generated war footage, including a July 17 clip of a purported "attack on Iran" assessed as 94.9 percent synthetic.
Assessment: This is the week's clearest escalation from data theft and DDoS toward physical-consequence sabotage on US soil — and the jump from one vendor to three signals broad reconnaissance and pre-positioning, not opportunistic hits. The access being built inside trusted engineering channels is what later converts into a wiper or a shutdown. For the Gulf, whose utilities run the same PLC stack, the advisory reads as a preview: the target set is defined by hardware, not by borders.