Iran Is Targeting American Water Systems — And the Attacks Are Just Getting Started

The Real Scope of Iran’s Water System Campaign Is Far Worse Than Reported

One month after the first signs of a coordinated cyberattack on U.S. municipal water systems appeared in suburban Minneapolis, the official narrative has quietly shifted beneath our feet.

Federal law enforcement originally said roughly 30 water systems — mostly in Minnesota — had been compromised. The attribution was clear: Iranian state hackers. The method was specific: programmable logic controllers, or PLCs, the industrial computers that regulate valves, water flow, and chemical treatment in drinking water systems.

Now the Cybersecurity and Infrastructure Security Agency, CISA, says more than 100 water providers in 12 states were actually targeted.

The initial estimate wasn’t necessarily a lie. It was a reflection of what agencies knew quickly — and what small-town utilities often don’t know at all.

The Numbers That Should Alarm You

CISA’s latest alert describes malicious activity targeting over 100 internet-exposed systems in the Water and Wastewater Systems sector, many accessed through PLCs connected directly to cellular modems. That last detail is critical. These are not hardened industrial control systems sitting behind air-gapped networks. They are devices with phone-line-level connectivity, accessible from anywhere with an internet search.

The geographic spread matters too. Wisconsin, Michigan, Minnesota — states bordering the Great Lakes, home to some of the world’s largest fresh water reserves. Twelve states coast to coast. The campaign was not localized. It was systematic.

Iranian state hackers have been probing American infrastructure for years. But this campaign represents something different: a deliberate shift from espionage and disruption toward sabotage-ready positioning. PLC access doesn’t just let you watch. It lets you control. It lets you adjust chemical dosages, alter flow rates, shut down treatment processes. The difference between monitoring a water system and being able to change what flows out of a tap is the difference between a spy and a saboteur.

The Silent Victims

Here is what makes this story genuinely unsettling: most of the 100-plus targeted utilities likely still do not know they were hit.

Lesley Carhart, a critical infrastructure first responder at Dragos, put it plainly. “The ability for small water utilities to detect a cyber incident and cyber threat is out of reach due to funding cuts and limited budgets,” she said. “A lot of them didn’t know for a long time, unfortunately.”

Small water systems serve millions of Americans. They are often run by two or three people who wear every hat — operator, accountant, IT support, emergency responder. When the federal government slashes infrastructure cybersecurity grants and municipal budgets shrink, these utilities become low-hanging fruit by default.

Carhart warned that the attack playbook is now widely available. Tools like AI and large language models have lowered the barrier to understanding how to interact with PLCs. “Once there’s an idea out there, like these utilities are exposed, they are easy to find,” she said. “People start using other people’s experiences to launch their own attacks and try the same tactics. So the knowledge is out there, the genie is out of the bottle.”

This is not a prediction. This is an observable trend in cybercrime. When state-sponsored tactics become commoditized through AI-assisted research, the attacker pool expands exponentially. Iran may have started this campaign. But it will not be the last actor to use it.

The Illinois Problem

Illinois is not among the twelve states CISA has publicly identified as hit. But that absence tells you more about American transparency policy than it does about American vulnerability.

NBC Chicago’s investigative team found that Illinois has no regulation requiring water systems to alert law enforcement or the public when they suffer a computer breach. In other words: even if Illinois utilities were targeted, they may never have reported it. They may still be operating under compromise right now.

This is a structural problem, not an Illinois-specific one. Across the country, critical infrastructure reporting remains voluntary in many sectors. Utilities fear reputational damage. They fear panic. They fear the cost of compliance more than the cost of a breach. The result is a shadow epidemic of undetected intrusions into systems that deliver one of the most fundamental things a modern state provides.

What Happens Next

The immediate implication is straightforward: the U.S. government likely has only mapped the tip of a much larger intrusion chain. If CISA is confirming 100 targets after a month, the actual number could be significantly higher. Many utilities will never report. Some may already be operating with backdoors still active in their control systems.

The secondary implication is geopolitical. Iran has demonstrated it can reach deep into American civilian infrastructure with relative impunity. No utility on the front list had adequate defenses. No breach triggered public alarm. The campaign achieved strategic effect — disrupting trust in basic services — without firing a single shot or poisoning a single drop.

The spillover risk is real. European water systems use similar PLCs. Asian municipal infrastructure relies on the same commercial controller vendors. The toolkit Iran built against American water systems is portable. Every country with underfunded small utilities and internet-exposed industrial controls is now on the same list.

What has not changed is the political response. There has been no emergency funding announcement. No mandatory breach disclosure framework. No public education campaign for the communities that depend on these systems every day.

The water keeps flowing. For now. But the question haunting engineers and analysts alike is what happens when the next breach isn’t a reconnaissance probe — but the real thing.