It wasn’t a nationwide water crisis… this time. But what was a warning for years is now stark reality:

The nation’s water infrastructure is an increasingly attractive target for cyber-attackers.

This summer, water and wastewater utilities in at least seven states reported cyber incidents to the FBI. Minnesota was hit particularly hard, with more than 30 water systems impacted.

I’m a recently-former television journalist—forever news junkie—so I’m always tuned in to NBC’s The Today Show before my workday starts here at United Systems. This story topped their newscast on the morning of July 31.

It immediately caught my attention. Not because I work with utilities, but because I’m a water customer. Everyone I know and love is, too.

And this journalist knows:

The bigger the impact, the bigger the story. And water is BIG.

370 quintillion gallons, to be exact. That’s how much water the U.S. Geological Survey calculates is on this planet. 10.98 quintillion gallons of that is fresh water.

We depend on it for daily life: from brushing our teeth, to cooking, to washing our hands.

So, like I said… BIG.

We also depend on utilities to get that water to us safely and quickly.

Attackers went after the modern tools that help them do that: internet-connected operational technology. It’s used to monitor and control water systems. In some cases, passwords and network settings were changed. Other utilities experienced loss of water pressure, flooding, and temporary disruptions. Some had to switch to manual operations while they worked to regain control of their systems.

There are no reports of widespread drinking-water contamination from this wave of attacks. But don’t mistake that as a sign of a limited threat.

In fact, the NSA, CISA, FBI, and EPA issued an urgent joint advisory about an active cyberattack campaign targeting Siemens S7 Series programmable logic controllers (PLCs) across critical infrastructure. Water and wastewater systems were specifically mentioned as being some of the most heavily targeted sectors.

In this newsie’s opinion, the headline now isn’t what happened. It’s not even what didn’t happen. It’s what could happen and what must be done to ensure critical infrastructure is protected.

Don’t make smart systems dumb

Modern utility infrastructure is smarter, and more connected, than ever.

Remote monitoring, automated controls, and connected devices allow utilities to operate more efficiently, respond to problems faster, and more easily manage infrastructure that spans many miles of service territory.

But that system is only as smart as you enable it to be. That means every connection must be secured.

The FBI specifically urges utilities to examine the security of internet-facing technology, including PLCs used to control physical processes and equipment.

A compromised account or device can potentially become a pathway to critical equipment like pumps, wells, valves, and treatment processes.

Those issues are even more pronounced for smaller utilities without dedicated cyber and security operations staff. A handful of employees are likely responsible for everything from treatment operations to customer service.

Budgets are tight. But you can’t afford to ignore these challenges, because cyber-attackers will exploit them.

The conversation must change

These vulnerabilities aren’t new, despite the sudden national headlines.

The EPA reported in February it had proactively identified cybersecurity vulnerabilities at 277 water systems in 2025. It worked with those systems to address the issues. The GAO previously warned that foreign governments, cybercriminals, and other threat actors have targeted U.S. water systems.

The difference today is that utilities are seeing how those vulnerabilities can translate into operational consequences.

This brings on calls for a stronger approach to cybersecurity, with it increasingly being called a mission-critical function for water utilities by entities like the American Water Works Association (AWWA). For years, it’s offered guidance to utilities to evaluate risks and improve cybersecurity maturity.

AWWA has also examined the possibility of industry-wide cybersecurity standards with federal oversight, a conversation gaining urgency following these recent attacks.

But standards alone won’t solve the problem.

Security must be built into the way utilities design, deploy, connect, and manage their infrastructure.

What can utilities do now?

The pace of water systems adopting digital technology isn’t slowing. That growth is a trend based on necessity. Your customers expect continuous progression toward better convenience, efficiency, and security.

These recent attacks should push the industry forward—toward infrastructure that’s smarter and more secure.

But individual utilities and their staff can take action now.

United Systems Chief Information Security Officer Darren Duncan works directly with utilities and authorities who track cyber threats and trends. He shared some of his expertise on this subject with local NBC affiliate WPSD-TV.

He provided several important questions utilities need to ask themselves after these recent cyber-attacks. Look for those in our next blog later this week.