Thirty towns and cities across Minnesota got hit by what officials called a "coordinated cyberattack" on their water systems last month. Some of those systems had to be shut down completely, forcing residents onto boil-water notices while operators scrambled to run treatment plants by hand.
Minnesota wasn't alone. Not even close.
At least seven states have now reported cyberattacks targeting water and wastewater systems, with some facilities forced into what federal agencies described as "sustained manual operations" — which is government-speak for "we had to turn everything off and do it the old-fashioned way because hackers got in."
Nine water systems in Michigan were also targeted. The FBI and the Environmental Protection Agency issued a joint warning about "operational disruptions" caused by cyber actors compromising internet-connected equipment at water treatment facilities. The Cybersecurity and Infrastructure Security Agency — CISA — followed up with an advisory stressing the importance of "restricting direct internet access" to operational technology at these plants.
We put men on the moon in 1969 with less computing power than your average coffeemaker. And in 2026, we can't keep foreign hackers out of the systems that make our tap water safe to drink because somebody plugged a water pump into a Wi-Fi router.
CISA's advisory pointed to Iranian-affiliated hackers as the likely culprits behind at least some of the intrusions. President Trump, speaking at Camp David on Friday, pushed back on the Iran attribution. Regardless of who's behind the keyboard, the vulnerability is the same — and it's been known about for years.
The FBI and EPA have warned about exactly this scenario before. Water systems are classified as critical infrastructure, sitting right alongside power grids and hospitals on the list of things we absolutely cannot afford to lose. Yet the security posture at hundreds of small and mid-sized water utilities across the country amounts to a default password and a prayer.
The bigger picture here isn't who hacked what. It's that we've spent the last several years pouring billions into green energy mandates, DEI compliance offices, and electric vehicle subsidies while the basic systems that keep American communities functioning — water, power, sewage — are running on equipment with the cybersecurity equivalent of a screen door on a submarine.
Every dollar Congress allocates to rename a federal building or fund a new "equity initiative" is a dollar that didn't go toward hardening the infrastructure that 330 million Americans rely on every single day.
That's not a cybersecurity problem. That's a priorities problem.