United States federal cyber defense and environmental agencies issued an urgent joint security advisory warning that foreign state-sponsored hackers and criminal extortion syndicates are intensifying targeted cyber attack campaigns against critical water and wastewater utilities across the nation. The joint alert, published by the Cybersecurity and Infrastructure Security Agency, the Environmental Protection Agency, and the Federal Bureau of Investigation, warns that malicious actors are actively scanning for, identifying, and compromising vulnerable industrial control systems managing municipal drinking water supplies.
The security advisory highlights a severe vulnerability landscape across America’s highly fragmented water infrastructure. Approximately 153,000 public water systems are operating across the United States, serving more than 300 million citizens. However, over 50,000 community water systems operate as small municipal utilities with constrained financial budgets, legacy industrial hardware, and zero dedicated full-time cybersecurity personnel. Federal investigators revealed that over 80% of inspected water utilities maintain basic security deficiencies, including internet-exposed human-machine interfaces, unpatched Programmable Logic Controllers, and unchanged factory default passwords.
The warnings follow a series of high-profile cyber intrusions targeting municipal water facilities in multiple states. State-backed threat actors originating from Iran, China, and Russia have executed remote intrusions against operational technology networks, tampering with chemical treatment controls, altering water pump pressure settings, and locking administrative billing systems with ransomware. Federal officials emphasized that while water treatment plant operators successfully intercepted recent physical intrusions before widespread public harm occurred, the accelerating volume of automated scanning requires immediate, mandatory cybersecurity hardening across all municipal utility networks.
TechGolly provides an in-depth cybersecurity analysis of the federal water utility warning, evaluating industrial control system vulnerabilities, default password exploit vectors, foreign state threat group tactics, chemical dosing risks, EPA regulatory audits, and the strategic roadmap for securing national critical infrastructure.
Unpacking the Anatomy of Water Infrastructure Vulnerabilities
To understand why municipal water facilities represent attractive targets for international threat actors, security architects must examine the physical and digital architecture governing modern water treatment operations.
Water treatment facilities rely on two distinct computer network layers: Information Technology (IT) networks and Operational Technology (OT) networks. Information Technology networks manage routine office administration, email communications, customer billing, and municipal accounting. Operational Technology networks—comprising Supervisory Control and Data Acquisition (SCADA) systems, Human-Machine Interfaces (HMIs), and Programmable Logic Controllers (PLCs)—physically operate the water facility, controlling raw water intake pumps, chemical filtration valves, chlorination dosing systems, and clean water storage tanks.
The primary vulnerability facing small and medium-sized water utilities is the improper integration of IT and OT networks. Historically, industrial control systems operated inside physically isolated, air-gapped facilities. However, over the past decade, municipal utilities connected local SCADA systems to internal corporate networks or the public internet, allowing utility operators to monitor water tank levels and adjust pump schedules remotely using mobile smartphones or home computers.
Connecting legacy industrial hardware to the public internet without proper network segmentation introduces catastrophic security risks. Industrial control hardware—such as PLCs manufactured decades ago—was engineered for physical durability rather than digital security. These legacy devices lack native encryption, digital certificate validation, activity logging tools, or multi-factor authentication requirements, leaving them completely vulnerable to basic network exploitation once a hacker locates their IP address.
Furthermore, threat actors utilize specialized search engines like Shodan and Censys to scan global internet address ranges continuously. These automated search tools locate internet-facing industrial control interfaces within minutes, allowing hackers thousands of miles away to identify unsegmented water treatment systems without firing a single complex cyber exploit.
The Default Password and Unpatched PLC Exploit Vector
The most pervasive vulnerability exploited during recent water utility breaches is the presence of unchanged factory default administrative passwords on internet-facing industrial hardware.
When water utilities purchase industrial cellular gateways, remote terminal units, or Unitronics Vision Series PLCs, manufacturers ship the equipment configured with simple, standardized factory passwords such as “1111,” “1234,” or “admin.” These default credentials are designed to allow technicians to complete initial installation easily. However, in thousands of municipal water facilities, installation contractors and local utility operators failed to change the factory default passwords before connecting devices to public cellular networks.
Threat actors exploit these default credentials through automated brute-force scripts. Once a hacker identifies an internet-connected Unitronics PLC or industrial router, an automated program inputs standard factory passwords. Upon securing administrative access, the hacker gains full control over the physical device, allowing them to modify system parameters, overwrite firmware, or lock local display screens.
Another common exploit vector is unpatched software vulnerabilities in remote-access software programs. During periods of emergency maintenance, utility operators frequently utilize commercial remote-desktop tools to allow vendors to troubleshoot equipment remotely. If these remote-access tools lack multi-factor authentication or run outdated software containing known security flaws, hackers can hijack remote desktop sessions to enter internal utility networks undetected.
Foreign State Threat Groups: Volt Typhoon, Cyber Av3ngers, and Sandworm
The joint advisory issued by federal defense agencies highlights a sophisticated, multinational threat actor landscape actively targeting American water infrastructure for strategic, political, and military objectives.
Federal intelligence agencies have identified three distinct categories of state-sponsored threat groups executing reconnaissance and disruptive cyber operations against United States water systems:
- First, Iran-linked threat actors operating under the moniker Cyber Av3ngers. This state-affiliated group executed a coordinated campaign targeting Israeli-manufactured Unitronics Vision Series PLCs deployed across American water treatment facilities. In a notable incident at the Municipal Water Authority of Aliquippa in Pennsylvania, Cyber Av3ngers breached an internet-connected water booster station, defacing the physical PLC control screen with anti-Israeli political messaging and forcing operators to switch the water pressure management system to manual control.
- Second, China-backed advanced persistent threat groups, most prominently Volt Typhoon. Intelligence agencies warned that Volt Typhoon is conducting long-term “living off the land” cyber intrusion campaigns targeting critical United States infrastructure, including water treatment systems, electrical power grids, port facilities, and telecommunications networks. Rather than deploying destructive malware immediately, Volt Typhoon hackers steal legitimate administrative credentials to maintain silent, long-term access inside critical networks, pre-positioning capabilities to execute disruptive cyber attacks during future geopolitical conflicts.
- Third, Russia-linked state actors and affiliated hacktivist groups, including Sandworm and the Cyber Army of Russia Reborn. Russian cyber groups executed direct industrial control system tampering against water facilities in Texas and Indiana. In one Texas water treatment facility, Russian threat actors breached the local SCADA system and modified tank level controls, causing an automated water storage tank to overflow for hours before operators detected the physical malfunction.
Ransomware Syndicates and Municipal Extortion Schemes
Alongside state-sponsored cyber espionage groups, financially motivated criminal ransomware syndicates pose a severe, daily operational threat to municipal water districts.
Criminal cybercrime syndicates—including LockBit, BlackBasta, and Akira—target municipal water systems because local government utilities frequently lack dedicated incident response teams and maintain weak network backups. Ransomware actors typically gain perimeter access by phishing utility employees, purchasing stolen remote-access credentials on dark web forums, or exploiting unpatched vulnerabilities in corporate edge routers.
Once inside the corporate IT network, ransomware actors exfiltrate sensitive administrative files, customer billing databases, and employee records before deploying encryption malware to lock corporate servers. Threat actors then demand multi-million-dollar ransom payments in cryptocurrency, threatening to publish confidential customer records on dark web leak sites or delete data backups if payment demands are rejected.
While ransomware groups typically target corporate IT networks rather than physical operational technology, an administrative IT breach can severely impair water utility operations. When ransomware locks customer billing systems, mapping software, and digital communication channels, utility managers are frequently forced to shut down automated water treatment operations manually out of caution, switching to manual valve operation until cybersecurity teams clean corporate networks.
Physical Risks: Chemical Dosing Tampering and Water Supply Safety
The ultimate concern driving federal emergency alerts is the potential for a cyber attack to compromise the physical safety and chemical purity of municipal drinking water.
Modern drinking water treatment is a precise chemical and biological engineering process. Raw water drawn from rivers, lakes, or underground aquifers undergoes multi-stage purification to remove dangerous pathogens, heavy metals, and industrial contaminants. Water treatment plants utilize automated chemical feed pumps regulated by PLCs to inject precise dosages of treatment chemicals:
- Chlorine and sodium hypochlorite are added to disinfect water and kill biological bacteria, viruses, and parasites.
- Fluoride is added at low concentrations to support dental health.
- Sodium hydroxide (lye) and lime are injected to adjust water pH levels, preventing acidic water from corroding lead and copper municipal distribution pipes.
- Coagulants like aluminum sulfate are added to bind suspended sediment particles together for filtration.
If a malicious hacker gains administrative access to a water plant’s SCADA interface or overrides a PLC controlling chemical feed pumps, they can alter chemical dosing parameters, turning life-saving treatment processes into severe public health hazards.
The real-world danger of chemical dosing manipulation was demonstrated during a high-profile cyber intrusion at a water treatment plant in Oldsmar, Florida. A remote hacker accessed the plant’s SCADA interface using an unmonitored TeamViewer remote access software program and attempted to increase the concentration of sodium hydroxide (lye) in the water supply from a safe level of 100 parts per million to a dangerous level of 11,100 parts per million. Sodium hydroxide is a corrosive chemical used in drain cleaners; in high concentrations, it causes severe internal chemical burns and tissue damage.
Fortunately, an attentive human operator observed the computer cursor moving across the screen independently, saw the chemical dosing parameters being changed to dangerous levels, and immediately reversed the automated commands before the contaminated water entered the municipal distribution network. However, the Oldsmar incident proved that remote cyber intrusions can directly threaten human life if physical safety overrides are absent.
EPA Safe Drinking Water Act Compliance Audits and Regulatory Enforcement
In response to expanding cyber threats, the Environmental Protection Agency is deploying its statutory authority under the Safe Drinking Water Act to enforce mandatory cybersecurity compliance across the water sector.
Section 1433 of the Safe Drinking Water Act, amended by America’s Water Infrastructure Act, mandates that all community water systems serving more than 3,300 people must conduct formal Risk and Resilience Assessments and prepare comprehensive Emergency Response Plans. These statutory assessments require water utilities to evaluate physical and cyber vulnerabilities across their electronic, computer, or other automated systems.
The EPA has significantly increased the frequency and rigor of its physical utility inspections. Federal environmental inspectors are auditing municipal water plants to verify that utilities maintain updated cybersecurity plans, enforce password security policies, and conduct regular data backups.
When EPA inspections uncover severe, unremediated cybersecurity deficiencies—such as internet-exposed PLCs or unsegmented IT-OT networks—the agency possesses statutory authority to issue formal administrative orders, levy civil financial penalties, and require water districts to execute mandatory corrective action plans within strict compliance timelines.
Strategic Roadmap for Hardening Municipal Industrial Networks
Securing America’s water infrastructure against state-sponsored hackers and criminal extortion syndicates requires implementing a comprehensive, multi-layered defensive strategy based on Zero-Trust engineering principles.
Federal agencies including CISA, the EPA, and the FBI recommend five immediate, mandatory technical countermeasures for all water and wastewater utility operators:
- First, complete removal of industrial control systems from the public internet. SCADA interfaces, HMIs, and PLCs must be disconnected from public IP addresses. If remote access is legally or operationally required, access must be routed exclusively through a secure Virtual Private Network (VPN) utilizing mandatory Multi-Factor Authentication (MFA).
- Second, universal elimination of default factory passwords. Utility operators must audit every connected industrial device, cellular router, and PLC, changing all default administrative passwords to long, complex passphrases stored in secure password management vaults.
- Third, strict physical and logical network micro-segmentation. Utilities must install industrial firewalls between corporate IT networks and operational technology networks, ensuring that an administrative email breach cannot spread laterally into physical water treatment systems.
- Fourth, implementation of physical and mechanical safety backstops. Water plants must install physical, non-digital mechanical overrides—such as pressure-relief valves, physical chemical flow limiters, and mechanical break switches—that physically prevent chemical pumps from over-dosing water supplies, regardless of erroneous automated commands sent by a compromised PLC.
- Fifth, establishing continuous offline configuration backups. Utilities must maintain up-to-date, offline backups of all PLC logic files, SCADA configurations, and system software, allowing engineering teams to restore operational controls rapidly if ransomware encrypts corporate servers.
To assist small and medium-sized municipal utilities that lack financial resources, federal programs such as the State and Local Cybersecurity Grant Program, administered by CISA and FEMA, provide dedicated grant funding to help local water districts procure security hardware, hire third-party security auditors, and train utility staff in industrial cybersecurity best practices.
Key Takeaways for Utility Directors, Municipal Leaders, and CISOs
The joint federal cyber warning targeting United States water utilities delivers vital strategic lessons for city council members, municipal utility directors, water treatment plant managers, and cybersecurity officers.
First, basic cyber hygiene is the most effective defense against critical infrastructure attacks. The vast majority of recent water utility breaches exploited simple, preventable security oversights—such as unchanged factory default passwords and unsegmented internet connections—rather than complex zero-day software exploits.
Second, operational technology networks require absolute isolation from corporate administrative systems. Implementing Zero-Trust network architecture and strict industrial firewalls ensures that corporate ransomware infections cannot cross into physical water treatment pipelines.
Third, physical safety backstops are essential for life-safety protection. Water utility managers must ensure that physical mechanical controls and human operator verification procedures backstop all automated chemical dosing and pressure management systems.
Finally, critical infrastructure defense is a shared national responsibility. Municipal leaders, federal environmental regulators, and private cybersecurity experts must collaborate transparently, utilizing federal grant funding and technical resources to harden America’s drinking water systems against expanding global cyber threats.
