cybersecurity, critical infrastructure, water systems, utilities, operational technology, power grid, energy sector, communications outages, emergency preparedness, FBI, EPA, CISA

Cyberattacks Are Reaching the Systems That Keep America Running — Is America Better Yet?

Cyberattacks have disrupted U.S. water operations in multiple states. Here is what is confirmed, what is not, and how households can prepare for longer utility and communications outages.

Roberto Zapatero

— 11 min read
Share

Cyberattacks have disrupted U.S. water operations in multiple states, while federal agencies say a separate Iranian-affiliated campaign has reached operational technology in water and energy systems. Here is what is confirmed, what is not, and how households can prepare for longer utility and communications outages.

Water operations have already been disrupted. Federal agencies say a separate campaign has reached operational technology used in water and energy systems. The immediate issue is not who gets credit for the attacks. It is whether the systems Americans depend on can keep working when someone reaches into their controls.

By Roberto Zapatero
Independent Forensic Investigative Journalist, Is America Better Yet?
Updated: August 15, 2026

On a day when the heat index neared 100 degrees, Braham, Minnesota, Mayor Nate George learned that his city's water system had stopped responding normally.

A public works operator saw the water-tower level falling while the well that should refill it was not responding. City officials said a cyberattack had shut down operating controls for the well and water-treatment plant. For a time, the community was relying on water already stored in its tower. Residents were asked to conserve.

The water remained safe, and crews restored the system.

But the important fact is what happened before the recovery:

Someone reached into the machinery that moves and treats a community's water and caused part of it to stop working.

That is the public-safety issue at the center of this story.

The attacks reached physical water operations

The Federal Bureau of Investigation and Environmental Protection Agency said water and wastewater utilities in at least seven states reported cyber incidents beginning July 27.

The attackers remotely accessed internet-facing programmable logic controllers, or PLCs. The FBI said the actors changed network addresses and passwords, causing operators to lose monitoring and, in some cases, control of connected equipment.

The FBI said reported operational effects included loss of water pressure and flooding.

That matters because pressure loss can create a second safety problem. The bureau warned that untreated groundwater could potentially enter pipes when pressure falls.

The public record reviewed for this article does not establish that the late-July attacks deliberately contaminated drinking water. A cyberattack on a water system is serious without turning a possible contamination pathway into a claim that people were poisoned.

More than 30 Minnesota water systems were targeted

Minnesota IT Services said a coordinated cyberattack targeted operational technology at more than 30 community water systems on July 26 and 27.

Braham experienced the clearest publicly described operational effect.

In Plymouth, Minnesota, communications used by water infrastructure were disrupted and later restored. Crews continued operating the system, and officials said water levels and quality were not affected.

That distinction is important. A communications failure does not always mean the physical service stops. But it can force people to operate with less automation, less remote visibility, or fewer normal ways to exchange information.

Michigan officials later reported attacks on nine water systems. They said the affected systems continued operating safely and no public-health impact was identified.

The FBI's public warning uses a minimum of at least seven states. IABY is keeping that federal minimum in the central count until agencies publish a fuller official accounting.

The act matters more than the flag on the attacker

The late-July water attacks remain under investigation.

Is America Better Yet? (IABY) located no public FBI attribution of that seven-state wave in the federal sources reviewed through August 15.

That does not mean attribution is unimportant. It means the public record supports two different evidence tracks, and they should not be blended.

In a separate 2026 campaign, the Cybersecurity and Infrastructure Security Agency, FBI, National Security Agency, EPA, Department of Energy, U.S. Cyber Command and the Treasury Department formally warned that Iranian-affiliated actors were exploiting internet-connected operational technology across U.S. critical infrastructure.

The advisory specifically identifies the Water and Wastewater Systems Sector, the Energy Sector, and government services and facilities.

Federal agencies said that separate activity had moved beyond simple access. They documented malicious changes to project files, manipulation of information shown on operator displays, operational disruption, and financial loss.

In one U.S. victim environment, the agencies said malicious logic overrode instructions used to maintain safe operating parameters. The July update also said changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without normal operator warnings.

That separate campaign is publicly attributed to Iranian-affiliated actors. The late-July seven-state water wave is not.

Both matter because both show the same basic danger: an internet connection can become a path from a remote computer to machinery that performs physical work.

What about electricity and other utilities?

The same class of operational technology is used well beyond drinking water.

The federal advisory says the separately attributed Iranian-affiliated campaign has targeted PLCs used in the Energy Sector.

That places energy infrastructure inside the documented threat picture.

But the public evidence reviewed for this article does not establish that the late-July water attacks caused a U.S. bulk-power blackout. The federal advisory also does not publicly name the energy-sector victims.

That limit should remain visible.

The danger does not need exaggeration. Federal agencies are already warning that malicious actors have reached technology that can control physical processes and interfere with safety logic.

The practical questions are whether utilities can isolate exposed systems, detect unauthorized access, fall back to manual operation, communicate with the public, and restore service safely when automation fails.

Communications can become part of the emergency

A utility outage can become a communications outage, and a communications outage can make every other emergency harder.

Power failures can affect cellular networks, home internet, payment terminals, traffic controls, local alerts and other communications services. Cyber incidents can also disrupt the communications links used by utilities themselves.

Plymouth's water-infrastructure communications disruption is a recent example of the difference between losing a communications layer and losing the underlying service. Crews kept the water system operating.

Resilience therefore requires more than backup electricity. It requires backup ways to receive information and reach people.

For households, that means a battery or hand-crank radio, paper contact information, charged battery banks, and a family plan that does not depend on one phone app or one network.

For local governments and utilities, it means redundant public-warning methods and a way to keep critical operations running when normal data links fail.

Federal investigators had already documented a broader weakness

The Government Accountability Office reported in May that U.S. water and wastewater systems face growing cyber risk as operational technology becomes more connected to information technology and the internet.

GAO said the country has close to 170,000 water and wastewater systems. Many face old technology, workforce shortages, limited financing and uneven cybersecurity capabilities.

Those conditions do not prove a system will be hacked.

They explain why a small utility may have fewer people, less money and less replacement equipment available when an attack reaches equipment that was never designed for today's threat environment.

The FBI's July warning tells utilities to remove PLCs from direct public-internet exposure, use strong and unique passwords, strictly control network access, review configurations, isolate vulnerable systems, replace end-of-life equipment, and maintain the ability to operate manually.

A utility that can safely fall back to manual operation has another layer between a cyber intrusion and loss of service.

Water, power and communications depend on one another

Critical infrastructure is not a set of independent boxes.

Water systems need electricity for pumps, controls, treatment and communications. Electric systems depend on communications and supporting technology. Hospitals, emergency services, fuel distribution, refrigeration, traffic control, cellular networks and payment systems can all become harder to operate when electricity or communications fail.

That does not mean one cyberattack will automatically collapse all of them.

It means governments, utilities and households should plan for cascading failures instead of assuming every outage will remain isolated.

What the evidence establishes

  • Water and wastewater utilities in at least seven states reported cyber incidents to the FBI beginning July 27.
  • Some incidents degraded water operations.
  • The FBI said reported effects included loss of pressure and flooding.
  • More than 30 Minnesota community water systems were targeted in a coordinated attack.
  • Braham temporarily lost operating controls for its well and water-treatment plant.
  • Plymouth experienced a water-infrastructure communications disruption but continued operating its system.
  • Michigan reported nine targeted systems that state officials said continued to operate safely.
  • A separate federal advisory attributes an ongoing campaign against U.S. operational technology to Iranian-affiliated actors.
  • That separate campaign includes water and energy infrastructure.
  • Federal agencies documented malicious changes capable of interfering with safe operating parameters, alarms, operator displays and other control functions.

What the evidence does not establish

  • That Iran carried out the late-July seven-state water attacks.
  • That the late-July incidents deliberately contaminated drinking water.
  • That a nationwide U.S. water emergency occurred.
  • That the late-July wave caused a U.S. bulk electric-grid blackout.
  • That every reported late-July incident came from the same attacker.
  • The identities of the energy-sector victims described in the separate federal advisory.

Those unknowns should stay unknown until evidence resolves them.

If utilities fail, prepare for more than 72 hours

Emergency planning should not depend on a cyberattack being the cause.

Hurricanes, tornadoes, heat waves, ice storms, fires, equipment failures and cyber incidents can produce the same household problem: the tap does not work, the lights do not come on, the refrigerator is warming, the phone cannot connect, or electronic payments stop working.

Current Ready.gov guidance calls for water and nonperishable food for several days. It does not describe three days as a maximum. IABY strongly recommends citizens prepare for much longer outages. Being ready in advance can be the key to surviving a disaster.

Is America Better Yet recommends a layered approach. Start with several days. When money, storage space and health needs allow, work toward a seven-day supply and then a 14-day household buffer.

That longer target is an IABY resilience recommendation, not a FEMA requirement.

Water

Keep at least one gallon of water per person per day for drinking and basic sanitation, and plan for more in hot weather, illness, pregnancy, pets or other special needs.

Do not assume tap water is unsafe simply because a utility reports a cyber incident. Follow the exact instructions from the local water authority and public-health agencies.

A boil-water advisory is not the same as a do-not-drink or do-not-use advisory. Boiling does not remove every chemical or toxin.

Keep some stored water in containers that are practical to carry if you have to leave.

Shelf-stable food

Build a rotating supply of foods your household already eats.

Favor foods that require little or no cooking and little added water: canned meat, fish, beans, vegetables and fruit; nut or seed butters; crackers; shelf-stable milk; ready-to-eat meals; cereal; dried fruit; protein or energy bars; and other foods appropriate to your health needs.

Keep a manual can opener.

If someone has diabetes, food allergies, kidney disease or another condition affected by diet, build the emergency pantry around that person's actual needs rather than a generic list.

Cooking without electricity

Plan first for meals that can be eaten without cooking.

If you use a camp stove, grill, charcoal burner or another fuel-burning cooker, use it outdoors and away from the home.

Never use a generator, camp stove, charcoal grill or other fuel-burning device inside a house, garage, basement, tent or other enclosed space.

Ready.gov advises keeping generators, camp stoves and charcoal grills outdoors and at least 20 feet from windows.

Do not use a gas oven or stove as a substitute for home heating.

Keep working carbon-monoxide alarms with battery backup.

Backup power

Start with equipment that protects life, cooling and communication.

Keep flashlights or headlamps, spare batteries, charged power banks, charging cables and a battery-powered or hand-crank radio.

A portable power station or properly installed generator can extend resilience, but prioritize the loads that matter most: medical equipment, refrigeration for critical medicine, communications and limited cooling.

Never connect a generator in a way that can backfeed utility lines. Permanent transfer equipment should be installed by a qualified electrician.

Heat can turn an outage into a medical emergency

During extreme heat, loss of electricity can become dangerous quickly.

A fan may improve comfort, but it should not be treated as a substitute for effective cooling when indoor conditions are dangerously hot.

Before an outage, identify cooling centers, libraries, malls, relatives, shelters or other air-conditioned locations you can reach.

During an outage, block direct sunlight, reduce indoor heat sources, move to the coolest safe area, take cool showers or baths when safe water is available, wear lightweight clothing, drink fluids and reduce strenuous activity.

Check on older adults, children, disabled people and anyone with chronic illness.

If the home is becoming dangerously hot, leave for a cooler place rather than trying to outlast the heat.

Confusion, fainting or other signs of heat stroke require emergency medical attention.

Medical needs

If someone in the household depends on oxygen equipment, a ventilator, CPAP, an infusion device, mobility equipment, refrigerated medicine or another power-dependent medical device, build the outage plan around that person first.

Have a device-specific backup-power plan and know what should happen if normal power cannot be restored.

Keep a paper list of medications, doses, allergies, doctors, pharmacies and emergency contacts.

For temperature-sensitive medicine, follow the product label, pharmacist or manufacturer guidance. Do not assume every refrigerated medicine can safely remain warm for the same amount of time.

Food safety when the refrigerator goes dark

Keep refrigerator and freezer doors closed.

CDC says an unopened refrigerator keeps food safe for about four hours. A full unopened freezer can keep food safe for about 48 hours, and a half-full freezer for about 24 hours.

Keep coolers and frozen gel packs ready.

Do not taste food to decide whether it is safe. When in doubt, throw it out.

Communications backup

Assume cell service and home internet may be limited even when your phone still has power.

Keep a battery or hand-crank radio and know which local stations carry emergency information.

Download or print important contact information before an emergency. Keep a paper list of family, medical, utility and emergency-management numbers.

Create a family communication plan with an out-of-area contact.

Text messages may sometimes get through when voice networks are congested, but do not depend on one method.

Know how your local government sends emergency alerts. FEMA's Integrated Public Alert and Warning System can distribute alerts through Wireless Emergency Alerts and the Emergency Alert System, including radio and television.

If you use accessibility-specific communication equipment, include its power, battery and backup needs in the plan.

Cash, transportation and fuel

Keep some cash in small denominations. Long power or communications outages can disable ATMs and card terminals.

Keep enough vehicle fuel that an ordinary local outage will not leave you stranded.

Do not store gasoline or other fuels inside living spaces or in unsafe containers.

Keep a basic paper map in case navigation or data service is unavailable.

Sanitation and pets

Plan for toilet and hygiene needs if water or pumps stop.

Keep soap, hand sanitizer, trash bags, toilet paper and basic cleaning supplies.

Pets need their own water, food, medicines, leashes or carriers and a plan for safe cooling.

Preparedness is not panic

Most of the recently reported water incidents were limited, and operators restored service.

That is good news.

It is also evidence that alert workers, manual controls and fallback plans matter.

The lesson is not that Americans should expect the water or power grid to collapse tomorrow.

The lesson is that attackers have already demonstrated access to machines that control physical infrastructure, and some communities have already lost normal water or communications functions because of cyber intrusions.

The responsible response has two parts.

Utilities should reduce avoidable exposure and build systems that fail safely.

Households should be able to get through a longer utility or communications outage without assuming water, electricity, refrigeration, cellular service, internet access or electronic payments will return on a fixed 72-hour schedule.

That is resilience.

Reporting note

Is America Better Yet? reviewed federal cyber advisories, GAO water-sector oversight, state and national incident reporting, and current federal household-preparedness guidance through August 15, 2026.

The late-July water incidents remain a Living Record. Attribution should be updated only when a named investigative authority releases a finding that supports the change.

Sources

I write for you,

— Roberto

isamericabetteryet.org

Copyright: © 2026 Roberto Zapatero / Is America Better Yet? All rights reserved.

Read more