{"id":30218,"date":"2026-08-06T20:28:28","date_gmt":"2026-08-06T15:28:28","guid":{"rendered":"https:\/\/usnews-14267fa.ingress-comporellon.ewp.live\/?p=30218"},"modified":"2026-08-06T20:28:28","modified_gmt":"2026-08-06T15:28:28","slug":"hackers-just-broke-into-americas-tap-water-how-scared-should-you-be","status":"publish","type":"post","link":"https:\/\/usnews-14267fa.ingress-comporellon.ewp.live\/?p=30218","title":{"rendered":"Hackers just broke into America\u2019s tap water. How scared should you be?"},"content":{"rendered":"<p><script>\r\n  atOptions = {\r\n    'key' : '644b717812d811d6a1c1fc5b6ccd6fa6',\r\n    'format' : 'iframe',\r\n    'height' : 90,\r\n    'width' : 728,\r\n    'params' : {}\r\n  };\r\n<\/script>\r\n<script src=\"https:\/\/www.highperformanceformat.com\/644b717812d811d6a1c1fc5b6ccd6fa6\/invoke.js\"><\/script>\r\n<br \/>\n<\/p>\n<div xmlns:default=\"http:\/\/www.w3.org\/2000\/svg\" id=\"zephr-anchor\">\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">In the teensy Midwestern town of Braham, homemade <a href=\"https:\/\/www.pieday.com\/\">pie capital<\/a> of Minnesota, something unusual in the municipality\u2019s computer systems <a href=\"https:\/\/brahammn.govoffice3.com\/vertical\/Sites\/%7B7EC913ED-A65B-4E08-A2EF-E535A7854808%7D\/uploads\/Water_Use_limited_statement_.jpg\">knocked<\/a> the city\u2019s entire water supply offline last week.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">Within a few hours, <a href=\"https:\/\/www.mprnews.org\/story\/2026\/07\/28\/30-minnesota-municipal-water-systems-targeted-cyberattack\">dozens of other Minnesota cities<\/a> discovered that their water and wastewater utilities, too, had been compromised, most likely as part of a <a href=\"https:\/\/www.wired.com\/story\/a-leaked-memo-ties-cyberattacks-on-minnesota-water-utilities-to-iran\/\">massive Iranian cyberattack<\/a>, the kind that <a href=\"https:\/\/www.cisa.gov\/resources-tools\/resources\/iranian-cyber-actors-may-target-vulnerable-us-networks-and-entities-interest\">US officials have been warning about<\/a> since the war began.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">At least a <a href=\"https:\/\/abcnews.com\/US\/12-states-face-cyberattacks-water-systems-sources\/story?id=135348482\">dozen states<\/a> have been affected by the attack, which <a href=\"https:\/\/time.com\/article\/2026\/08\/02\/what-to-know-about-the-u-s-water-systems-cyberattacks\/\">briefly led to a flurry<\/a> of small-town service disruptions, boil-water notices, and <a href=\"https:\/\/www.fbi.gov\/investigate\/cyber\/alerts\/2026\/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions\">local flooding<\/a>. Water wells, dams, sewers, and pipelines are some of America\u2019s <a href=\"https:\/\/infrastructurereportcard.org\/cat-item\/drinking-water-infrastructure\/\">oldest and creakiest<\/a> pieces of infrastructure, built long before the internet existed, and certainly long before AI made hacking much <a href=\"https:\/\/www.vox.com\/politics\/468746\/ai-cyber-attacks-china-claude-anthropic\">easier<\/a>. While you may assume most hackers are in it for the money or for data, some have <a href=\"https:\/\/www.usatoday.com\/story\/news\/nation\/2024\/10\/25\/hacking-attacks-on-critical-infrastructure-more-common\/75792143007\/\">targeted critical infrastructure<\/a> like water systems or energy grids in ploys for control or disruption \u2014 or worse still, as acts of war.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">And, as last week\u2019s attacks show, the nation\u2019s water system is woefully unprepared. But how worried should you be that the very infrastructure that keeps our water taps running is, apparently, hackable?<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">When we say the water supply got hacked, what we really mean is that someone, somewhere has broken into the computer that controls a local water treatment plant or reservoir, and is now pulling the levers, like the one that <a href=\"https:\/\/www.bbc.com\/news\/world-us-canada-55989843\">decides how much of a corrosive chemical<\/a> can safely go into cleaning the water that comes out of your tap.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">These levers were once manual buttons and knobs operated in-person by real live humans, meaning that \u2014 barring a natural disaster, bomb, or break-in \u2014 protecting them was about as simple as building a fence and hiring guards. Increasingly, however, these levers have gone digital, meaning that they are now remotely operable from anywhere in the world.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">Those upgrades have been convenient, allowing technicians to monitor and troubleshoot problems in real time. But, in the process, they have exposed at times centuries-old infrastructure to distinctly modern vulnerabilities. Most local water systems are operated by local authorities, don\u2019t have a dedicated IT team, and lack the money or resources to thoroughly protect themselves without some extra help. Hackers know this, which is why they\u2019ve increasingly targeted local agencies in such attacks.<\/p>\n<\/div>\n<div class=\"duet--article--block-placement _13j8zv41 _13j8zv40 duet--article--article-body-component\">\n<div style=\"position:relative\">\n<div class=\"_10sa9omj\">\n<div class=\"\">\n<div style=\"background-image:none\" class=\"duet--media--content-warning _1wmfnm10\">\n<div class=\"duet--article--image-gallery-image _1hhpe710\" style=\"aspect-ratio:1.781296\" id=\"dngyOmltYWdlOjQ5ODE3NQ==\"><a class=\"_1hhpe711\" href=\"https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0,0,100,100\" data-pswp-height=\"2021\" data-pswp-width=\"3600\" target=\"_blank\" rel=\"noreferrer\"><img alt=\"Workers on walkways over green lagoons in an indoor water treatment plant.\" data-chromatic=\"ignore\" loading=\"lazy\" decoding=\"async\" data-nimg=\"fill\" class=\"_1ssnpw50\" style=\"position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url(&quot;data:image\/svg+xml;charset=utf-8,%3Csvg xmlns='http:\/\/www.w3.org\/2000\/svg' %3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'\/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'\/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'\/%3E%3CfeComposite operator='out' in='s'\/%3E%3CfeComposite in2='SourceGraphic'\/%3E%3CfeGaussianBlur stdDeviation='20'\/%3E%3C\/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mN8+R8AAtcB6oaHtZcAAAAASUVORK5CYII='\/%3E%3C\/svg%3E&quot;)\" sizes=\"(max-width: 639px) 100vw, (max-width: 1023px) 50vw, 700px\" srcset=\"https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=256 256w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=376 376w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=384 384w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=415 415w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=480 480w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=540 540w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=640 640w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=750 750w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=828 828w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=1080 1080w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=1200 1200w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=1440 1440w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=1920 1920w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=2048 2048w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=2400 2400w\" src=\"https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1156759987.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=2400\"\/><\/a><\/div>\n<\/div>\n<\/div>\n<p><figcaption class=\"duet--article--dangerously-set-cms-markup pn04iq2 _1dh7zmha\">A water treatment plant in Minnesota, where a coordinated cyberattack targeted dozens of municipal water systems last week.<\/figcaption><cite class=\"duet--article--dangerously-set-cms-markup pn04iq2 _1dh7zmh5\">Star Tribune via Getty Images<\/cite><\/p>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">\u201cWith great connectivity comes great responsibility,\u201d said Joshua Corman, founder of I Am The Cavalry, a nonprofit focused on helping critical infrastructure withstand hackers. And yet, even when it comes to critical services like water, \u201cour dependence on connected technology is growing faster than our ability to secure it.\u201d<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">About <a href=\"https:\/\/www.epa.gov\/dwcapacity\/learn-about-capacity-development\">97 percent of water systems<\/a> are small, run by local agencies that often barely lock the proverbial front door. America\u2019s water system is like an expensive heirloom bicycle that\u2019s been left on a busy street, protected by only the flimsiest of padlocks. And that very vulnerability has made tiny towns like Braham prime targets for faraway adversaries. Accessing the computers that operate most water systems \u2014 known as programmable logic controllers or PLCs \u2014 is often as simple as entering a username and password on a public-facing webpage. Sometimes, <a href=\"https:\/\/www.fbi.gov\/investigate\/cyber\/alerts\/2026\/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions\">there is no real password<\/a> at all, because PLCs were initially intended to be accessed only within locked, secure facilities, not on the open internet. If the US wants to avoid a far more severe version of what happened last week, then it will need to start taking the security of tiny water systems like Braham\u2019s seriously.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">\u201cAny sociopath from anywhere in the world can see these things on the internet,\u201d said Corman. And in the case of last week\u2019s attacks, \u201cthese were devices with no password, no firewall or VPN shielding them \u2014 they just had to log in\u201d as whoever the intended operator was, and just like that, they were inside a local water plant.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p><h2 class=\"duet--article--dangerously-set-cms-markup\"><strong>How did this happen at all? <\/strong><\/h2>\n<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">When municipalities began hooking up their old water and wastewater systems to the internet \u2014 a trend that <a href=\"https:\/\/www.wwdmag.com\/utility-management\/article\/10938841\/smart-water-metering-digitizing-to-survive\">accelerated<\/a> during the pandemic as water operators, like everyone else, adapted to remote work \u2014 cybersecurity was rarely front of mind, neither for individual utilities nor for regulators as a whole.<\/p>\n<\/div>\n<div class=\"duet--article--block-placement _13j8zv42 _13j8zv40 duet--article--article-body-component\">\n<div style=\"position:relative\">\n<div class=\"_10sa9oml\">\n<div class=\"\">\n<div style=\"background-image:none\" class=\"duet--media--content-warning _1wmfnm10\">\n<div class=\"duet--article--image-gallery-image _1hhpe710\" style=\"aspect-ratio:0.666667\" id=\"dngyOmltYWdlOjQ5ODE4MQ==\"><a class=\"_1hhpe711\" href=\"https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0,0,100,100\" data-pswp-height=\"3000\" data-pswp-width=\"2000\" target=\"_blank\" rel=\"noreferrer\"><img alt=\"Two water towers on a rural American street.\" data-chromatic=\"ignore\" loading=\"lazy\" decoding=\"async\" data-nimg=\"fill\" class=\"_1ssnpw50\" style=\"position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url(&quot;data:image\/svg+xml;charset=utf-8,%3Csvg xmlns='http:\/\/www.w3.org\/2000\/svg' %3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'\/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'\/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'\/%3E%3CfeComposite operator='out' in='s'\/%3E%3CfeComposite in2='SourceGraphic'\/%3E%3CfeGaussianBlur stdDeviation='20'\/%3E%3C\/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mN8+R8AAtcB6oaHtZcAAAAASUVORK5CYII='\/%3E%3C\/svg%3E&quot;)\" sizes=\"(max-width: 639px) 100vw, (max-width: 1023px) 50vw, 700px\" srcset=\"https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=256 256w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=376 376w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=384 384w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=415 415w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=480 480w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=540 540w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=640 640w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=750 750w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=828 828w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=1080 1080w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=1200 1200w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=1440 1440w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=1920 1920w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=2048 2048w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=2400 2400w\" src=\"https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2176138345.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=2400\"\/><\/a><\/div>\n<\/div>\n<\/div>\n<p><figcaption class=\"duet--article--dangerously-set-cms-markup pn04iq2 _1dh7zmha\">Most of America\u2019s small-town water systems are unusually vulnerable to cyberattacks.<\/figcaption><cite class=\"duet--article--dangerously-set-cms-markup pn04iq2 _1dh7zmh5\">Arin Yoon\/The Washington Post<\/cite><\/p>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">\u201cWe have more cybersecurity regulations for your credit card than we have for the nation\u2019s water supply,\u201d said Corman. Only recently have some municipalities begun to take steps to decrease the exposure of their water plants to hacks. In March, New York state, for example, launched a set of grants and basic <a href=\"https:\/\/www.govtech.com\/security\/new-york-puts-9m-toward-strengthening-water-cybersecurity\">cybersecurity regulations<\/a> mandating security training for all water operators.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">Basic cybersecurity hygiene isn\u2019t always enough. More than <a href=\"https:\/\/www.security.org\/digital-safety\/credit-card-fraud-report\/\">half of all credit card holders<\/a> have been hacked, even <em>with<\/em> the help of mandatory firewalls and data encryption. You can imagine how vulnerable our water must be without the assistance of such guardrails. In a worst-case scenario, a malicious actor could quite literally <a href=\"https:\/\/www.theguardian.com\/world\/2025\/aug\/14\/russian-hackers-control-norwegian-dam-norway\">open the floodgates<\/a>, as Russian hackers did to a Norwegian dam last year. They could <a href=\"https:\/\/www.nytimes.com\/2021\/02\/08\/us\/oldsmar-florida-water-supply-hack.html\">poison the tap water<\/a>, as a still unidentified hacker almost did in Florida in 2021, dialing up the levels of sodium hydroxide used at a water treatment plant by over 100 times its normal levels. In a severe scenario, they could indefinitely cut off access to all water entirely.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">The good news is, none of this happened last week. Nobody died, nobody lost water for more than a few hours, no fire hydrants ran dry, and no hospitals were forced to cut off their dialysis machines (which can use more than a <a href=\"https:\/\/pmc.ncbi.nlm.nih.gov\/articles\/PMC12282630\/\">hundred gallons of water<\/a> per treatment session). There\u2019s no need to panic, and your drinking water is almost certainly still safe to drink, <a href=\"https:\/\/www.epa.gov\/ground-water-and-drinking-water\/basic-information-about-lead-drinking-water\">assuming it was safe before<\/a>. Even the city of Braham, within a few hours, was able to bring its <a href=\"https:\/\/www.mprnews.org\/story\/2026\/07\/27\/braham-cyberattack-knocked-water-system-offline\">water tower back online<\/a>, pumping groundwater back to its 1,800 residents.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p><h2 class=\"duet--article--dangerously-set-cms-markup\"><strong>How do we avoid cyber-armageddon?<\/strong><\/h2>\n<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">If you\u2019ve watched the Julia Roberts and Mahershala Ali-starring thriller <em>Leave the World Behind<\/em>, in which a cyberattack apocalyptically spoils a family vacation, then you might have some idea of where this story could go.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">Cyberattacks on critical infrastructure can be extraordinarily dangerous, but thankfully, none have directly cost lives or severely disrupted services in this country so far. If the US wants to keep it that way, that will mean doing more to help small cities like Braham adapt and better monitor for potential threats. As it stands, of the roughly 151,000 water facilities in the US, only about 420 participate in voluntary information sharing on their own cybersecurity practices, says Corman, who has been <a href=\"https:\/\/www.wired.com\/story\/undisruptable27-us-critical-infrastructure-cybersecurity\/\">leading his own project<\/a> that recruits volunteers to give free cybersecurity support to water utilities in the nation\u2019s roughly 6,000 hospital towns, where a disruption could be particularly deadly.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">Cybersecurity experts like Corman believe that hackers from other nations like China have already <a href=\"https:\/\/www.wired.com\/story\/what-happens-if-china-hacks-the-us-water-supply-war-game-volt-typhoon\/\">quietly established cyber intrusions<\/a> in countless local US utilities, water systems, and power grids, lying in wait to attack or act as leverage if a <a href=\"https:\/\/www.vox.com\/videos\/490284\/can-there-ever-really-be-one-china\">conflict arises<\/a>.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">Unfortunately, the Trump administration has hardly treated last week\u2019s attacks as symptoms of a system in need of much broader strengthening, at least in its public statements. \u201cI think Minnesota is behind it. You know who\u2019s behind it? Minnesota,\u201d the <a href=\"https:\/\/apnews.com\/article\/fact-check-trump-minnesota-prescriptions-immigration-7adb2340586cabc2162c39d6f4bc9d92\">president baselessly claimed<\/a> during a Cabinet meeting last Friday. \u201cI think the governor is behind it. I don\u2019t think there was an Iranian cyber attack.\u201d<\/p>\n<\/div>\n<div class=\"duet--article--block-placement _13j8zv41 _13j8zv40 duet--article--article-body-component\">\n<div style=\"position:relative\">\n<div class=\"_10sa9omj\">\n<div class=\"\">\n<div style=\"background-image:none\" class=\"duet--media--content-warning _1wmfnm10\">\n<div class=\"duet--article--image-gallery-image _1hhpe710\" style=\"aspect-ratio:1.54972\" id=\"dngyOmltYWdlOjQ5ODE2Ng==\"><a class=\"_1hhpe711\" href=\"https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0,0,100,100\" data-pswp-height=\"2323\" data-pswp-width=\"3600\" target=\"_blank\" rel=\"noreferrer\"><img alt=\"A group including Governor Tim Walz, Lieutenant Governor Peggy Flanagan, Saint Paul Mayor Melvin Carter and General Manager Patrick Shea stand in the center of a lime softening clarifier during a tour of McCarrons Water Treatment Plant on January 26, 2023 at St. Paul Regional Water Services in Maplewood, Minn.\" data-chromatic=\"ignore\" loading=\"lazy\" decoding=\"async\" data-nimg=\"fill\" class=\"_1ssnpw50\" style=\"position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url(&quot;data:image\/svg+xml;charset=utf-8,%3Csvg xmlns='http:\/\/www.w3.org\/2000\/svg' %3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'\/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'\/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'\/%3E%3CfeComposite operator='out' in='s'\/%3E%3CfeComposite in2='SourceGraphic'\/%3E%3CfeGaussianBlur stdDeviation='20'\/%3E%3C\/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mN8+R8AAtcB6oaHtZcAAAAASUVORK5CYII='\/%3E%3C\/svg%3E&quot;)\" sizes=\"(max-width: 639px) 100vw, (max-width: 1023px) 50vw, 700px\" srcset=\"https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=256 256w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=376 376w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=384 384w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=415 415w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=480 480w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=540 540w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=640 640w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=750 750w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=828 828w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=1080 1080w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=1200 1200w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=1440 1440w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=1920 1920w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=2048 2048w, https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=2400 2400w\" src=\"https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-1461446356.jpg?quality=90&amp;strip=all&amp;crop=0%2C0%2C100%2C100&amp;w=2400\"\/><\/a><\/div>\n<\/div>\n<\/div>\n<p><figcaption class=\"duet--article--dangerously-set-cms-markup pn04iq2 _1dh7zmha\">Gov. Tim Walz touring a water treatment plant in Minnesota.<\/figcaption><cite class=\"duet--article--dangerously-set-cms-markup pn04iq2 _1dh7zmh5\">Alex Kormann\/Star Tribune via Getty Images<\/cite><\/p>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">Just a few months ago, he proposed <a href=\"https:\/\/www.afcea.org\/signal-media\/us-administration-proposes-707-million-cut-cisa-programs\">$707 million<\/a> in cuts to the US Cybersecurity and Infrastructure Security Agency (CISA), the agency responsible for protecting the nation\u2019s infrastructure from cyberattacks. He did so, at least in part, <a href=\"https:\/\/subscriber.politicopro.com\/article\/2026\/04\/white-house-budget-cyber-cisa-00858276\">out of anger<\/a> over the agency\u2019s role in confirming the validity of the <a href=\"https:\/\/www.nbcnews.com\/tech\/security\/trump-fires-head-u-s-election-cybersecurity-after-he-debunked-n1248063\">2020 election results<\/a>. If Iran is, indeed, responsible, for the recent water system intrusions, all of this means that Trump has effectively made us more vulnerable to the consequences of a conflict he initiated.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">At the end of the day,\u201cnation-state hackers do not respect the jurisdictional lines separating federal, state, and local responsibility,\u201d Jen Easterly, who led CISA under the Biden administration, wrote in the <a href=\"https:\/\/www.nytimes.com\/2026\/08\/02\/opinion\/iran-water-hack-trump.html\">New York Times<\/a> this week. \u201cThey search for the most vulnerable way to disrupt American life, and too often they find it in small communities that lack the resources to defend themselves.\u201d Easterly\u2019s role <a href=\"https:\/\/www.politico.com\/news\/2026\/04\/22\/sean-plankey-withdraws-nomination-cisa-00887136\">has remained vacant<\/a> for the past 18 months.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">Kurt Gaudette, a senior vice president at the cybersecurity firm Dragos, told me that water systems have got to get into the habit of monitoring their networks for suspicious activity. Most power utilities have begun doing so in recent years, with some <a href=\"https:\/\/www.eenews.net\/articles\/energy-security-bills-on-the-house-floor-this-week\/\">bipartisan backing<\/a> from Congress.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">In some cases, however, the most cost-effective and safest way to avoid a repeat of last week\u2019s mess might be to unplug the most vital controls \u2014 like the one that decides the chemical levels in a water treatment plant \u2014 from the web entirely.<\/p>\n<\/div>\n<div class=\"duet--article--article-body-component\">\n<p class=\"duet--article--dangerously-set-cms-markup duet--article--standard-paragraph _10sa9omi itxwjq1 itxwjq0 pn04iq1\">As Corman puts it, \u201cif you can\u2019t protect it, disconnect it.\u201d<\/p>\n<\/div>\n<aside class=\"_1tzd3in0 _10sa9om11\">\n<p class=\"_1tzd3in1\">You\u2019ve read <!-- -->1<!-- --> article<!-- --> in the last month<\/p>\n<div class=\"_1tzd3in2\">\n<div class=\"_1tzd3in3\">\n<p class=\"_1tzd3in4\">Here at Vox, we&#8217;re unwavering in our commitment to covering the issues that matter most to you \u2014 threats to democracy, immigration, reproductive rights, the environment, and the rising polarization across this country.<\/p>\n<p class=\"_1tzd3in4\">Our mission is to provide clear, accessible journalism that empowers you to stay informed and engaged in shaping our world. By becoming a<!-- --> <!-- -->Vox Member, you directly strengthen our ability to deliver in-depth, independent reporting that drives meaningful change.<\/p>\n<p class=\"_1tzd3in4\">We rely on readers like you \u2014 join us.<\/p>\n<\/div>\n<div class=\"_1tzd3in5\"><img alt=\"Swati Sharma\" loading=\"lazy\" width=\"59\" height=\"69\" decoding=\"async\" data-nimg=\"1\" style=\"color:transparent\" srcset=\"\/_next\/image?url=%2Fstatic-assets%2Fheadshots%2Fswati.png&amp;w=64&amp;q=75 1x, \/_next\/image?url=%2Fstatic-assets%2Fheadshots%2Fswati.png&amp;w=128&amp;q=75 2x\" src=\"https:\/\/www.vox.com\/_next\/image?url=%2Fstatic-assets%2Fheadshots%2Fswati.png&amp;w=128&amp;q=75\"\/><\/p>\n<div class=\"_1tzd3in7\">\n<p class=\"_1tzd3in8\">Swati Sharma<\/p>\n<p class=\"_1tzd3in9\">Vox Editor-in-Chief<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/aside>\n<\/div>\n<script async=\"async\" data-cfasync=\"false\" src=\"https:\/\/pl30214220.effectivecpmnetwork.com\/9ab3d4df8a7e1a6171e16ddbf732cc19\/invoke.js\"><\/script>\r\n<div id=\"container-9ab3d4df8a7e1a6171e16ddbf732cc19\"><\/div>\r\n\n","protected":false},"excerpt":{"rendered":"<p>In the teensy Midwestern town of Braham, homemade pie capital of Minnesota, something unusual in the municipality\u2019s computer systems knocked the city\u2019s entire water supply offline last week. Within a few hours, dozens of other Minnesota cities discovered that their water and wastewater utilities, too, had been compromised, most likely as part of a massive&#8230;<\/p>\n","protected":false},"author":1,"featured_media":30219,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/platform.vox.com\/wp-content\/uploads\/sites\/2\/2026\/08\/gettyimages-2253193258.jpg?quality=90&strip=all&crop=0%2C8.6721407245896%2C100%2C82.655718550821&w=1200","fifu_image_alt":"","footnotes":""},"categories":[17],"tags":[],"class_list":["post-30218","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-political-news"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/usnews-14267fa.ingress-comporellon.ewp.live\/index.php?rest_route=\/wp\/v2\/posts\/30218","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/usnews-14267fa.ingress-comporellon.ewp.live\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/usnews-14267fa.ingress-comporellon.ewp.live\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/usnews-14267fa.ingress-comporellon.ewp.live\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/usnews-14267fa.ingress-comporellon.ewp.live\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=30218"}],"version-history":[{"count":0,"href":"https:\/\/usnews-14267fa.ingress-comporellon.ewp.live\/index.php?rest_route=\/wp\/v2\/posts\/30218\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/usnews-14267fa.ingress-comporellon.ewp.live\/index.php?rest_route=\/wp\/v2\/media\/30219"}],"wp:attachment":[{"href":"https:\/\/usnews-14267fa.ingress-comporellon.ewp.live\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/usnews-14267fa.ingress-comporellon.ewp.live\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/usnews-14267fa.ingress-comporellon.ewp.live\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}