Quick answer: In July and August 2026, Iran-linked hackers known as CyberAv3ngers targeted water systems in at least a dozen US states, affecting more than 100 facilities, and disrupted operational technology at more than 30 municipal water systems in Minnesota. The same group had previously hacked industrial controllers at US water utilities in 2023. The attacks exploited industrial devices exposed to the internet.
| Key facts | |
|---|---|
| Date | July to August 2026 (earlier campaign in November 2023) |
| Targets | Water utilities in at least a dozen US states |
| Type of attack | Attacks on industrial control systems (operational technology) |
| Attacker | CyberAv3ngers, linked to Iran’s Revolutionary Guard (IRGC) |
| Impact | More than 100 facilities targeted; operational technology disrupted at 30+ Minnesota municipal systems |
| Root cause (lesson) | Industrial controllers reachable from the internet, often with weak or default passwords |
Timeline
- November 2023: CyberAv3ngers compromise Unitronics industrial controllers at US water utilities; CISA issues an advisory.
- July 2026: Operational technology is disrupted at more than 30 municipal water systems in Minnesota.
- August 2026: Attacks on water systems in at least a dozen states affect more than 100 facilities.
What happened
Water utilities use programmable controllers to run pumps, valves and treatment processes. Many small utilities have limited security budgets, and some of these controllers are reachable from the internet. In summer 2026, during a period of conflict involving Iran, the IRGC-linked group CyberAv3ngers targeted water systems across at least a dozen US states, affecting more than 100 facilities. In Minnesota, operational technology was disrupted at more than 30 municipal water systems.
Not the first time
In November 2023, CISA warned that CyberAv3ngers had compromised Unitronics programmable logic controllers used in water and wastewater systems, in some cases defacing their screens. The 2026 attacks showed the same weakness had not been fixed everywhere.
Lessons for your organization
- Never expose industrial controllers or their management interfaces directly to the internet.
- Change default passwords on every operational technology device.
- Use MFA for remote access to industrial systems.
- Keep manual operation procedures so water can still be treated safely if controls are lost.
- Follow CISA advisories and use free federal assessment services for utilities.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. Learn more about network segmentation, a key control for industrial systems. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Frequently asked questions
Who is attacking US water systems?
CyberAv3ngers, a group linked to Iran’s Islamic Revolutionary Guard Corps, was behind the 2023 and 2026 attacks.
How many water facilities were affected in 2026?
More than 100 facilities in at least a dozen states were targeted, and over 30 municipal systems in Minnesota had operational technology disrupted.
How can water utilities protect themselves?
Remove industrial controllers from direct internet access, change default passwords, use MFA for remote access and keep manual operating procedures.
