FBI and CISA Warn Iranian Hackers Are Altering Control Logic at US Water Systems

On July 23, 2026, CISA, the FBI, the NSA, and the EPA jointly updated advisory AA26-097A, warning that Iranian-affiliated cyber actors have been actively manipulating programmable logic controllers (PLCs) across US critical infrastructure — including water and wastewater systems — since at least March 2026. The advisory goes further than the agencies’ previous warnings in one specific and alarming way: it states that in at least one intrusion, attackers changed a controller’s programming logic to disable critical shutdown and alarm functions, leaving processes able to enter unsafe conditions without alerting operators. This is the difference between a utility being scanned and a utility being steered, and it escalates a story WaterVerge has been tracking since the Handala breach claim against California Water Service earlier this month.

What the Advisory Says

AA26-097A was originally published April 7, 2026, and has now been updated twice — most recently on July 22, 2026, with the public warning issued July 23. The updates broaden the picture in three directions.

The target list grew. The original advisory focused on Rockwell Automation controllers. The July update adds equipment from Schneider Electric and Siemens — the other two vendors whose hardware runs a large share of American municipal water treatment. A utility that reviewed its exposure in April based on the Rockwell-only guidance may have concluded it was unaffected and stopped looking.

The sectors grew. The advisory names Water and Wastewater Systems, Energy, and Government Services and Facilities, explicitly including local municipalities — the small and mid-size systems least likely to have a dedicated operational-technology security staff.

The activity is no longer theoretical. The agencies describe actors attempting to download malicious project files onto controllers and manipulate data displayed on human-machine interface (HMI) and SCADA screens, producing what the advisory calls operational disruption and financial loss at affected organizations.

The actors are attributed to Iran’s Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC), operating under the CyberAv3ngers persona — the same identity behind the 2023 campaign against Unitronics devices at US water utilities.

Why PLCs Are the Weak Point in a Water System

A drinking water plant is, in automation terms, a chemistry experiment that never stops. Chlorine dose, pH adjustment, coagulant feed, filter backwash, pump speed, tank level — each is governed by a controller executing a small program in a loop, thousands of times a minute.

That controller is a PLC. It is not a general-purpose computer. Most were designed for reliability in a dusty pump house over a 20-year service life, not for adversarial network conditions. Many ship with authentication disabled by default. Many are, in practice, directly reachable from the public internet, because a contractor needed remote access in 2014 and nobody revisited the decision.

CISA’s guidance for closing this gap is unglamorous and specific:

Remove PLCs from direct internet exposure; put a secure gateway and firewall in front of them
Eliminate inbound port exposure and route all remote access through a mediated gateway with multi-factor authentication
Apply the Rockwell Automation patch for CVE-2021-22681 and all available Studio 5000 Logix Designer updates
Deploy unidirectional data diodes or DMZ architectures for any required IT-to-OT data flow
Enable authentication on every PLC and industrial controller
Remove remote-access capability from controllers that do not operationally require it

The July 22 revision added guidance on detecting malicious modifications inside reusable code modules in Rockwell PLC programs — a meaningful detail, because a tampered shared module propagates to every routine that calls it, and a plant operator reviewing only the top-level program would not see it.

What “Disabling Shutdown and Alarm Functions” Actually Means

This is the phrase in the advisory that matters most, and it deserves plain translation.

Water treatment safety does not rest primarily on operators watching gauges. It rests on interlocks — automated logic that says: if chlorine residual drops below a threshold, alarm and stop distributing; if turbidity spikes past the filter’s limit, divert to waste; if a pump cavitates, shut it down before it destroys itself.

An attacker who rewrites that logic does not need to cause a dramatic failure. They need only remove the tripwires and wait for an ordinary bad day. The plant then behaves normally on the operator’s screen while the physical process drifts outside its safe envelope — and because HMI and SCADA display data can also be manipulated, the screen may keep reporting normal values while it does.

The practical failure modes are the ones this site covers constantly: a loss of adequate disinfection lets coliform bacteria through, a filter breakthrough sends turbidity past the limit that keeps Cryptosporidium out of finished water, and a chemical-feed error puts a chlorine or pH excursion into the distribution system. These are the same endpoints as a mechanical failure — reached deliberately.

How This Differs From the Cal Water Claim

WaterVerge covered the Handala group’s claim against California Water Service on July 17. The two stories look similar from a distance and are quite different up close.

The Cal Water incident, as reported, was an IT-side intrusion and data-theft claim — corporate systems, business records, customer data. Serious, but on the business network.

AA26-097A describes operational technology compromise, confirmed and attributed by four federal agencies: the controllers that physically operate treatment and distribution equipment. The recurring worry in water-sector security is precisely the bridge between those two environments — an attacker who enters through IT and crosses into OT. The advisory’s emphasis on data diodes and DMZ architecture between IT and OT is a direct response to that pathway.

The Money Problem Underneath

Every mitigation in the advisory costs money and staff a typical American water utility does not have. There are roughly 50,000 community water systems in the United States, and the overwhelming majority serve small populations with a handful of employees. A gateway, a firewall, MFA, network segmentation, and someone qualified to audit PLC code are not line items those budgets contain.

The federal funding picture is moving the wrong way for exactly those systems. WaterVerge has tracked the proposed 90 percent cut to State Revolving Fund appropriations in the FY2027 EPA budget and the $125 million redirected out of lead pipe replacement to wildland fire management. The SRF is the primary federal mechanism through which small systems finance capital work of any kind, cybersecurity included. Louisiana’s statewide failing grades for water systems illustrate the baseline: systems that cannot reliably fund pipe replacement are not positioned to fund OT security architecture.

What Residents Should Do

There is no consumer action that hardens a utility’s PLCs, and it is worth being clear that no US water system has been reported to have delivered unsafe water as a result of this campaign. What residents can reasonably do is be prepared for the failure modes an OT incident produces — which are the same ones a main break or a power failure produces.

Know your utility’s notification channel. Sign up for text or email alerts. In an incident where operators are working from degraded instrumentation, the public notice may be the fastest reliable signal you get. Our boil-water advisory guide covers what a notice does and does not mean.
Keep a short water reserve. One gallon per person per day for three days covers nearly every disruption scenario, cyber or mechanical.
Read your annual Consumer Confidence Report. It will not discuss cybersecurity, but it tells you your system’s size, source, treatment, and violation history. Our guide to understanding your CCR walks through it.
Test if you want your own baseline. A utility’s data can be manipulated; a sample from your tap analyzed by a certified lab cannot. Our guide to testing your tap water covers what to order and what it costs.
Filtration is not a cyber defense, but a certified point-of-use filter does provide independent protection against several of the contaminants a disinfection failure would let through. Our reverse osmosis and under-sink filter guides cover certified options.

What Comes Next

Three things to watch.

Whether the advisory gets updated again. It has been revised twice in four months, each time widening the affected hardware. A third revision naming additional vendors would suggest the campaign is still expanding rather than being contained.

Whether EPA gets enforcement authority. EPA is a co-author of the advisory but has no mandatory cybersecurity standard for drinking water systems — its 2023 attempt to require cyber assessments through sanitary survey rules was withdrawn after legal challenge. Advisories are guidance. Nothing in AA26-097A compels a utility to do anything.

Whether the incidents surface publicly. The advisory says disruption occurred and organizations took financial losses, but it names no utility. Water systems face no general federal obligation to disclose a cyber incident to their customers. If your utility was affected, you would most likely not know.

How WaterVerge Tracks This

WaterVerge builds its city and state pages from EPA SDWIS compliance data and UCMR 5 monitoring results — records of what was measured in finished water, regardless of the cause. A cyber-induced treatment failure severe enough to breach a standard would appear in SDWIS as a violation like any other, which is the practical reason we watch the compliance record rather than the press release. We will update this article as the advisory is revised or affected systems are identified.