The FBI Describes Disrupted Water Controllers and Names No Country; Unnamed Officials Name Iran
A multi-state campaign against internet-facing controllers at US water utilities entered its second week with the investigating bureau still silent on who is responsible. The only Iran attribution on the record belongs to anonymous intelligence sources quoted by one newspaper.
The FBI has published a sector alert on malicious cyber actors targeting internet-facing programmable logic controllers at water and wastewater utilities, the page title stating that the intrusions are causing operational disruptions. The bureau’s page carried a stamp of roughly 6 August. NBC News reported on or around 3 August that the FBI had counted municipal water systems targeted in seven states over a single week. Route Fifty’s headline of 6 August — “More US water systems struck by hackers” — indicates the seven-state count has since been overtaken, though no outlet retrievable today has published the current figure. The freshest in-window reporting is Nextgov/FCW, which reported around 7 August that CISA is still finding water-system control interfaces exposed to the open internet while the intrusions continue.
The Iranian attribution sits in a different category. The Washington Post reported on 1 August that several states had reported cyberattacks and that spy agencies suspect Iran of targeting water systems — framing it as suspicion held by intelligence agencies rather than a finding. A NewsNation headline of roughly 3 August states plainly that the FBI has not confirmed who is behind the campaign. That gap has now held for more than a week. It is also not the first formal warning of its kind: Nextgov reported on or about 7 April 2026 that pro-Iran hackers were targeting US industrial control systems, on the basis of a government advisory. The August activity continues a pattern already documented four months ago.
Assessment: Two things are being conflated in most coverage: an advisory the government has published, and an attribution the government has not. Readers should hold them apart. An unnamed-source attribution to Iran is cheap to make and impossible to test, and it arrives in a fortnight when Iran’s leverage is being priced in other rooms; it would be equally cheap for Tehran-aligned actors to accept credit they have not earned. Watch two things: whether the FBI alert page is revised to name a state actor, and whether CISA publishes the number of exposed controllers it keeps finding. That second figure is the one that measures American exposure rather than Iranian intent.