Water Hack Hits 12 States; Ex-FERC Chair’s 18-Month Blackout Warning

KEMETIC MINDS
Infrastructure Watch — Daily Update — August 26, 2026

---

Within the last 24 hours, two unsettling pictures have sharpened: suspected Iranian-linked hackers have hit water utilities in at least 12 states, and a former federal regulator’s worst-case scenario warns that nine coordinated attacks could black out the entire U.S. grid for 18 months or more (Facilities Dive, 2026; Yahoo News, 2026). Here is what the sourcing shows — and what remains unproven.

• Suspected Iran-linked threat groups targeted vulnerable programmable logic controllers at drinking and wastewater utilities in at least 12 states, including Minnesota, Michigan, Georgia, South Dakota and New Jersey (Facilities Dive, 2026).
• In Minnesota, more than 30 community water systems were hit in a “coordinated attack” from July 26-27; officials in South St. Paul, Plymouth, Maple Plain and Braham said water safety was not affected (Facilities Dive, 2026).
• Georgia’s Clayton County Water Authority issued a boil water advisory after a July 27 attack briefly disrupted operations, restoring service within hours after testing confirmed the supply was safe (Facilities Dive, 2026).
• New Jersey utilities shifted to manual operations after internet-exposed devices blocked remote monitoring, and state officials said customers had uninterrupted access to safe drinking water (Facilities Dive, 2026).
• In 2013, gunmen disabled 17 transformers at a PG&E substation in 19 minutes; ex-FERC chair Jon Wellinghoff’s analysis warns nine such attacks could black out the U.S. for 18 months or more (Yahoo News, 2026).
• A CISA-hosted NIAC draft report says some transformer orders take 2 to 41 years, with one major U.S. manufacturer disclosing a five-year wait (Yahoo News, 2026).

1. Suspected Iran-Linked Hackers Hit Water Systems in 12 States

Federal and state authorities are investigating a series of coordinated cyberattacks targeting drinking and wastewater treatment facilities across the U.S., with utilities in at least 12 states impacted (Facilities Dive, 2026). The affected states include Minnesota, Michigan, Georgia, South Dakota and New Jersey (Facilities Dive, 2026). Threat groups with suspected links to Iran have targeted vulnerable programmable logic controllers — the devices used to monitor and control industrial systems — as well as human machine interfaces, the dashboards for monitoring water levels and temperatures (Facilities Dive, 2026).

The first public discovery began in Minnesota, where more than 30 community water systems were targeted in a “coordinated attack” from July 26-27 (Facilities Dive, 2026). Officials in South St. Paul, Plymouth, Maple Plain and Braham confirmed they were attacked but stated that water safety was not affected (Facilities Dive, 2026).

In Georgia, the Clayton County Water Authority said an attack on July 27 briefly disrupted its OT systems; officials issued a boil water advisory and restored service within a few hours after testing confirmed the supply was safe (Facilities Dive, 2026). New Jersey authorities responded to two confirmed July incidents in which vulnerable internet-exposed devices temporarily prevented operators from monitoring or managing systems remotely (Facilities Dive, 2026). A spokesperson for the NJ Office of Homeland Security and Preparedness said staff shifted quickly to manual operations, with no disruption to service, and customers had uninterrupted access to safe drinking water (Facilities Dive, 2026).

The attacks began days after CISA and the FBI issued a July warning about expanded targeting of vulnerable PLCs in the water and energy sectors (Facilities Dive, 2026). Axios reports that AI is making critical infrastructure easier to attack, while an AOL opinion piece argues the campaign will grow from water into power, transit and wastewater — attackers scan horizontally across thousands of systems, the author writes, while defenders fix vertically, one device at a time (Axios, 2026; AOL, 2026).

---

2. U.S. Grid Faces an 18-Month Blackout Worst Case

The blueprint was drawn in 2013: gunmen needed 19 minutes to disable 17 giant transformers at a PG&E substation near San Jose, firing roughly 120 shots and targeting cooling systems before disappearing into the night (Yahoo News, 2026). Utility workers spent 27 days restoring that single substation (Yahoo News, 2026).

Former Federal Energy Regulatory Commission chair Jon Wellinghoff later ran the numbers and arrived at a scenario that stops most readers cold: nine such attacks, coordinated across the U.S. grid’s three interconnections — the Western, Eastern and Texas systems — could black out the entire country (Yahoo News, 2026). His estimated recovery window, as reported by the New York Times Magazine: 18 months or more (Yahoo News, 2026).

The reporting itself attaches an honest caveat: the figure is Wellinghoff’s scenario warning, “not a proven forecast” — but the vulnerabilities underneath it are documented and real (Yahoo News, 2026). Destroying high-voltage transformers doesn’t just cut power; it destroys equipment that takes years to replace, with some units weighing upward of 500,000 pounds and built to order by a shrinking pool of manufacturers (Yahoo News, 2026).

A CISA-hosted NIAC draft report finds that some transformer orders take between 2 and 41 years, and one major U.S. manufacturer disclosed a five-year wait (Yahoo News, 2026). In Tehran, Energy Minister Abbas Aliabadi claimed his country’s power network is among the region’s most stable, saying “even with the complete exhaustion of the enemy’s arsenal, it is not possible to bring the country’s electricity generation network to a halt” and citing more than 1,000 power-generating units and capacity above 103,000 MW, up from about 7,000 MW at the 1979 revolution (PressTV, 2026). The Telegraph, for its part, published an argument that net zero is weakening the grid’s resistance to covert foreign attacks (The Telegraph, 2026).

---

What’s Disputed or Unconfirmed

The Iran link is still a suspicion, not a verdict: Facilities Dive describes the groups as having “suspected links to Iran,” and the federal and state investigation remains open (Facilities Dive, 2026). The AOL opinion piece asserts “Iranian-linked hackers” as fact — a characterization by an opinion author, not a confirmed finding (AOL, 2026).

The 18-month national blackout figure is likewise a modeled scenario, explicitly not a proven forecast, while Iran’s energy minister is an interested party in an active conflict and his claims of grid invincibility are one-sided statements that have not been independently verified (Yahoo News, 2026; PressTV, 2026). The AOL and Telegraph pieces are opinion content rather than news reporting, and across the water campaign no utility has confirmed any actual contamination of drinking water — Minnesota towns said safety was unaffected, and Georgia restored service after testing confirmed the supply was safe (AOL, 2026; The Telegraph, 2026; Facilities Dive, 2026).

---

🛡️ Free Preparedness Guides

Two free, printable checklists you can download and keep on hand — one for water-supply
disruptions, one for power outages.

---

References

1. Axios. (2026, August 25). AI is making critical infrastructure easier to attack. axios.com
2. Facilities Dive. (2026, August 25). What we know about the hacking campaign against US water systems. facilitiesdive.com
3. AOL.com. (2026, August 25). Opinion – Iran’s attacks on US water systems are just the beginning. aol.com
4. Latest news from Azerbaijan. (2026, August 26). Iran's power grid can withstand full-scale attack, energy minister says. news.az
5. PressTV. (2026, August 26). Energy minister: Iran's power grid can withstand full-scale attack. presstv.co.uk
6. The Telegraph. (2026, August 25). Net zero is weakening the grid’s resistance to covert foreign attacks. telegraph.co.uk
7. Yahoo. (2026, August 25). Expert Warns U.S. Grid Could Face an 18-Month Blackout Scenario. yahoo.com

---