Water infrastructure under attack: Why foreign hackers are targeting utilities

The shift in strategy

Real talk: the days of hackers just wanting a quick payout are lowkey over. Senior officials at the EPA are sounding the alarm that foreign actors and hacktivist networks have shifted their focus to critical infrastructure. Instead of just holding data for ransom, they are actively trying to mess with the computerized controls that manage our drinking water and wastewater systems.

"Everyday life completely crumbles" when these systems go down, says EPA Assistant Administrator for Water Jess Kramer. If you think about it, everything from the hospital you visit to the daycare down the street relies on this. When these systems are hit, it’s not just a tech glitch—it’s a total vibe check on our entire society.

Why it’s happening

It’s giving major security flaws. Many of our water utilities are running on aging infrastructure that was never built to live on the modern internet. EPA Assistant Administrator for Enforcement and Compliance Assurance Jeff Hall notes that some facilities are still missing basic safety like firewalls or multi-factor authentication. In some wild cases, they haven't even changed default passwords, and critical system info is just chilling online for anyone to find.

Since 2025, the EPA has flagged over 900 security holes across the country. Hackers are getting into these systems to manipulate pumps and valves, and because many utilities are dealing with staff shortages, they are struggling to keep up with the defense.

The recent receipts

We’ve already seen this in action. Back in July, a coordinated attack hit over 30 water systems in Minnesota, forcing teams to go manual. More recently, foreign actors breached two smaller utilities in Colorado. While the water remained safe in those cases, it’s a massive W for the hackers that they even got in at all.

Why it matters

The threat is getting more sophisticated, and the EPA is currently playing a game of catch-up. While they are helping utilities patch these basic holes, the agency doesn't have the legal power to force every system to report cyber incidents. It’s a high-stakes race between the hackers trying to "crumble" our infrastructure and the teams working to secure the grid before the next big attack.