Utilities in Twelve States Say They Were Hit, Four Will Say So by Name

Water and wastewater utilities in at least 12 US states have reported cyberattacks on their operational technology, according to ABC News on 4 August, citing unnamed sources; the count was carried on 5 August by The Record and SecurityWeek. Four of those states are publicly named or officially confirmed. Minnesota reported first: more than 30 community water systems targeted on 26 and 27 July. Michigan has confirmed a “small number” of communities saw malicious cyber activity. South Dakota has at least one city. In Georgia, the Clayton County Water Authority said on Monday 3 August that it “experienced a temporary disruption affecting a portion of its operational systems and water service in parts of north Clayton County” — a disrupted pump station, falling pressure in some areas, and a precautionary boil-water advisory since lifted. The other eight states are not identified.

The federal government has warned about the technique without attributing these incidents. Nick Andersen, Acting Director of the Cybersecurity and Infrastructure Security Agency, told Recorded Future News that “CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLC) at water utilities,” and urged owners “to remove publicly exposed PLCs and other operational technology from the internet as soon as possible.” A CISA advisory the week of 27 July said attacks on PLCs have “resulted in boil water notices and sustained manual operations.” That is government-asserted. The link between these particular 12 states and Iran is not: it rests on unnamed sources speaking to ABC News and CBS News, and The Record’s own formulation is that “multiple sources pointed the finger at Iran.” Public federal attributions of this campaign: none. Operational effects reported to the FBI have included loss of pressure and flooding — the mechanism, SecurityWeek notes, by which untreated ground water can seep into pipes.

Assessment: The 12-versus-4 split is the only hard measurement here, and it measures disclosure, not intrusion. Any chart of the rising state count — seven on 5 August in lower-tier reporting, twelve by the 7th — is tracking how many utilities decided to talk, which is why the eight unnamed states are the open question rather than a footnote. Two things to distrust. First, the four-month-old EPA/FBI/CISA/NSA joint advisory of 7 April on Iranian-affiliated attacks against water systems is circulating as though it were this week’s response; it is not, and it is the likeliest error in weekend coverage. Second, note that the senior on-the-record voice on a multi-state infrastructure campaign is an acting director. If no formal attribution arrives, the refusal becomes the story.