Water Utilities in 12 States Hit in Coordinated Hacking Spree

KEMETIC MINDS
Infrastructure Watch — Daily Update — August 21, 2026

---

A coordinated cyberattack spree has hit drinking and wastewater utilities in at least 12 states, with federal and state investigators working the case even as officials insist the water itself was never compromised. Also in today’s brief: a 10-day power outage still darkening northwestern Indiana, and Russia’s escalating strikes on Ukraine’s power grid and water infrastructure.

• Utilities in at least 12 states — including Minnesota, Michigan, Georgia, South Dakota and New Jersey — were hit in a series of coordinated cyberattacks on drinking and wastewater treatment facilities (Cybersecurity Dive, 2026).
• More than 30 Minnesota community water systems were targeted in a “coordinated attack” from July 26-27 against programmable logic controllers and their monitoring dashboards; officials in four confirmed-hit cities said water safety was not affected (Cybersecurity Dive, 2026).
• Georgia’s Clayton County Water Authority issued a boil water advisory after a July 27 attack briefly disrupted operations, restoring service within hours after testing confirmed the supply was safe (Cybersecurity Dive, 2026).
• Iran has the strongest motive and has previously attempted to hack U.S. water systems, according to former FBI deputy assistant director Cynthia Kaiser (DW.com, 2026).
• More than 70,000 people in northwestern Indiana remain without power more than a week after Aug. 11 storms, and seven people have died across the state (PBS NewsHour, 2026).
• Russia struck Ukraine’s power grid for the 230th time as interceptor stocks run low, and separately hit a critical infrastructure facility threatening Kyiv’s hot water supply (MSN, 2026; Ukrinform, 2026).

1. Water Supply: Hacking Campaign Spreads Across 12 States

Federal and state authorities are investigating a series of coordinated cyberattacks targeting drinking and wastewater treatment facilities across the U.S. (Cybersecurity Dive, 2026). Utilities in at least 12 states were impacted, including Minnesota, Michigan, Georgia, South Dakota and New Jersey (Cybersecurity Dive, 2026).

The first public discovery of the threat began in Minnesota, where more than 30 community water systems were targeted in a “coordinated attack” from July 26-27 (Cybersecurity Dive, 2026). Hackers hit programmable logic controllers (PLCs) as well as human machine interfaces — the dashboards for monitoring water levels or temperatures (Cybersecurity Dive, 2026).

Officials in South St. Paul, Plymouth, Maple Plain and Braham confirmed they were attacked, but stated that water safety was not affected (Cybersecurity Dive, 2026). In Georgia, the Clayton County Water Authority said an attack on July 27 briefly disrupted its OT systems; officials issued a boil water advisory and restored service within a few hours after testing confirmed the water supply was safe (Cybersecurity Dive, 2026).

New Jersey authorities responded to two confirmed cyber incidents in July, both involving vulnerable internet-exposed devices that temporarily prevented operators from monitoring or managing them remotely (Cybersecurity Dive, 2026). “In both cases, staff shifted quickly to manual operations, and there was no disruption to service,” a spokesperson for the NJ Office of Homeland Security and Preparedness said, adding that “customers had uninterrupted access to safe drinking water throughout” (Cybersecurity Dive, 2026).

The attacks began days after CISA and the FBI issued a July warning about expanded targeting of vulnerable PLCs in the water and energy sectors (Cybersecurity Dive, 2026). Hackers originally began targeting PLCs made by Rockwell Automation (Cybersecurity Dive, 2026).

Former FBI deputy assistant director Cynthia Kaiser, now head of the Halcyon Ransomware Research Center, told DW that Iran has the strongest motive and had previously attempted to hack U.S. water systems (DW.com, 2026). Joshua Corman, former CISA chief strategist who now runs I Am The Cavalry, warned that an attack on water systems could bring the U.S. to a standstill, affecting everything from hospitals to data centers (DW.com, 2026).

Overseas, Russian forces deliberately targeted a critical infrastructure facility in Kyiv on Aug. 20 — the first such attack on the capital in several months — and Kyiv Mayor Vitalii Klitschko said residents of the Desnianskyi and parts of the Dniprovskyi districts could experience disruptions to hot water supply (Ukrinform, 2026). In the Holosiivskyi district, drone debris fell onto a business center, causing a fire; one person was killed and two others were injured (Ukrinform, 2026).

---

2. Power Supply: Indiana Outage Drags Into Day 10

More than 70,000 people in northwestern Indiana are without power more than a week after a series of storms downed trees, knocked out power lines and flooded neighborhoods, and seven people have died across the state (PBS NewsHour, 2026). Power has been out for the region since Aug. 11, when 100-mile-an-hour winds swept through Indiana near the Illinois border; initially, some 300,000 customers lost electricity (PBS NewsHour, 2026).

In Gary, about 20,000 customers are still without power and air conditioning, and residents are posting daily updates and frustrations on social media (PBS NewsHour, 2026). “We are now on day 10 no power in Gary, Indiana,” resident Adriana Harris said (PBS NewsHour, 2026).

Gary officials say they will provide residents with three hot meals a day, tarps and charging stations (PBS NewsHour, 2026). Mayor Eddie Melton said: “To the families and to the citizens of Gary, we are standing with you. We are praying with you” (PBS NewsHour, 2026).

Internationally, Russia-Ukraine energy attacks have entered a dangerous new phase, according to MSN: with Ukraine down to one-third of its Patriot interceptors, Russia is launching its fifth consecutive winter campaign early in August (MSN, 2026).

---

What’s Disputed or Unconfirmed

The attribution of the water utility attacks is not yet confirmed: the sourcing describes threat groups “suspected to be the work of Iran-linked threat groups,” and the Iran motive assessment comes from a former FBI official’s expert opinion rather than an official public attribution (Cybersecurity Dive, 2026; DW.com, 2026).

The Ukrinform account of the Kyiv strike reflects Ukrainian officials’ wartime reporting and could not be independently verified; the MSN report on Ukraine’s interceptor stocks likewise presents one side of an active conflict (Ukrinform, 2026; MSN, 2026).

In Indiana, residents accuse local officials of not doing enough while officials say they are providing resources and support — a dispute the sourcing leaves unresolved (PBS NewsHour, 2026).

---

🛡️ Free Preparedness Guides

Two free, printable checklists you can download and keep on hand — one for water-supply
disruptions, one for power outages.

---

References

1. Cybersecurity Dive. (2026, August 20). What we know so far about the hacking campaign against US water systems. cybersecuritydive.com
2. DW.com. (2026, August 20). Who is trying to hack the US water supply?. dw.com
3. Ukrinform. (2026, August 20). Russian forces attack critical infrastructure facility in Kyiv, possible disruptions to hot water supply. ukrinform.net
4. PBS NewsHour. (2026, n.d.). Indiana residents frustrated amid 10-day power outage following storms. pbs.org
5. MSN. (2026, August 21). Russia strikes Ukraine power grid for 230th time; depleted interceptors can't stop it. msn.com

---