Suspected Iran-Linked Hackers Hit Water Systems in Seven States

Key points

• Attackers remotely accessed programmable logic controllers at water systems across seven U.S. states.
• Operators lost monitoring and control, and water operations were degraded.
• Connected equipment involved included pumps, valves, chillers, fire panels, badge readers and elevators.
• No CVE has been tied to the campaign; investigators are still assessing possible Iranian links.
• Severity is rated medium, but exposed operational technology remains a major concern.

In early August, suspected Iran-backed actors gained remote access to PLCs used by water utilities in seven U.S. states. The activity affected water systems rather than only ordinary business networks, and investigators are still examining whether Iranian state interests directed the operation. No CVE has been associated with the incident.

The operational impact was significant: personnel lost the ability to monitor processes and issue commands, and water operations were degraded. Reports also point to a wider set of connected equipment, including chillers, badge readers, elevators, pumps, valves and fire panels. That mix suggests the intruders may have reached beyond industrial controllers into building and security systems tied to the same environments.

Why this matters is straightforward. Water utilities are critical infrastructure, and remote access to PLCs can allow an attacker to alter physical processes, disrupt treatment or distribution, or mask what is happening. Even when the goal is not destructive, losing visibility and control can force operators into manual workarounds and create safety, public health and compliance risks.

The absence of a CVE does not mean there was no weakness. Operational technology is often exposed through remote-access paths, weak credentials, flat networks and unmonitored engineering workstations. A seven-state scope may indicate common exposure patterns, coordinated targeting, or both. Attribution remains unresolved, so agencies should avoid treating the Iran link as final.

What to watch next: whether authorities identify additional victims, publish indicators or clarify the intrusion path. Utilities and other government facilities with similar OT should urgently review remote access, network segmentation and controller logs. Severity is medium, but the potential for physical-process disruption keeps the incident high-attention.

What to do now

1. Inventory all internet-reachable PLCs and OT devices, then disable direct remote access and require VPN or zero-trust access with MFA.
2. Segment operational technology from IT, business and guest networks using firewalls and strict allowlists.
3. Replace default or shared credentials, disable unused services and ports, and enforce unique accounts for engineers and operators.
4. Enable logging on PLCs, engineering workstations and remote-access gateways, and alert on unexpected logic changes or login anomalies.
5. Apply available firmware and software updates where feasible; if patching is not possible, add compensating controls around the device.
6. Back up PLC logic and configurations offline, test restoration, and document manual fallback procedures for operators.
7. Brief staff on incident reporting and coordinate with relevant cyber authorities if suspicious OT access is found.

Original source

Help Net Security