Twelve States Have Disclosed Water-System Intrusions and Not One Federal Agency Has Named Iran

The Record’s headline on 6 August put the tally at twelve states, with South Dakota and Georgia the newest to announce incidents at water and wastewater systems. CBS News published the same figure the same day, framed as “at least 12 states report cyberattacks on water systems possibly linked to Iran-backed hackers, sources say” — the hedge and the anonymous sourcing both sitting in the headline itself. Axios had already run the jump to twelve on 4 August, two days ahead of both. The low end of the series belongs to different publishers: the Washington Post on 1 August reported “several states” with spy agencies suspecting Iran, and a Forbes contributor column the same day counted seven. Anyone charting seven to twelve is charting two outlets at opposite ends of a line, and is charting announcements rather than confirmed breaches.

The document the coverage rests on is older than the coverage. CISA advisory AA26-097A, “Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure,” was issued around mid-July, roughly three weeks before the state disclosures it is now being cited alongside. The most substantive piece in the window is Nextgov’s 7 August report that CISA still finds water-system controls exposed to the open internet during the multistate hacks — a story about the attack surface rather than the attacker. What no outlet has published is a date range for when the intrusions occurred, or whether twelve states means twelve separate operations or one campaign against a shared vendor or SCADA integrator. No Iranian denial surfaced in the window either.

Assessment: Treat this as a disclosure curve. State agencies choose when to speak, and a cluster of announcements four days apart is at least as consistent with regulators comparing notes after a federal advisory as with a fresh wave of access. The next real event is a named CISA or FBI attribution — or an explicit refusal to make one. If the access turns out to predate the mid-July advisory, the “twelve states” framing inverts from campaign to backlog. One regional silence is worth noting: Gulf utilities run the same exposed control interfaces Nextgov describes, and no GCC regulator has been heard from while Washington’s Iran file is otherwise crowded.