Following the coordinated attack against 30 Minnesota water and wastewater utilities from July 26-27, 2026, hackers have attacked at least 11 other state water systems in the last week. As of July 30, 2026, the Federal Bureau of Investigation (FBI) confirmed that at least seven states were affected and issued an alert detailing the hackers’ actions and their impact on water and wastewater systems.
Shortly thereafter, both Georgia and Michigan confirmed that they were targeted and experienced “hostile cyber activity,” including nine systems in Michigan, though both states reported no operational disruption or public health concern.
As of today, it is being reported that “at least 12 states have been hit.” In addition to Minnesota, Michigan, and Georgia, a water system in South Dakota reported a cyberattack “that appears to be part of the same campaign.”
In addition to alerts issued by the FBI and the Cybersecurity and Infrastructure Security Agency, Infracritical published a detailed report on the Minnesota attack and—to a lesser extent—Michigan, including the attack overview and vector, threat actor profile, and the public health risk to residents as a result of the attack happening during a regional heat event. The report notes that, for the first time confirmed in U.S. water sector history, “at least one utility experienced flooding as a direct result of PLC manipulation — the first cyber-caused flooding event documented in U.S. water infrastructure. This indicates adversary willingness to cause physical infrastructure damage, not merely access loss or service interruption.”
The report provides a statewide hardening roadmap that state utility operators should consider in the face of this ongoing threat by foreign adversaries.
The fact that the hackers of 12 statewide water systems did not think twice about damaging physical infrastructure is a wake-up call that our water, electrical, and financial systems must be hardened against these new cyber warfare threats for national security.