Since then, water utilities in at least seven states, including Michigan, New Jersey, and Georgia, have reported cyber incidents to the FBI. Some reports put the number closer to a dozen. No US agency has formally blamed Iran, but federal and state officials reportedly believe Tehran directed the attacks. In July, the US Cybersecurity and Infrastructure Security Agency (CISA) also linked Iran to similar attacks this spring on internet-connected systems that manage US utilities.
The attacks caused no apparent damage or disruption to drinking water supplies. But they exposed a troubling vulnerability: A conflict thousands of miles away can reach Americans through something as basic as the water supply.
The water weapon. Water vulnerabilities are a risk that Eurasia Group, GZERO’s parent company, highlighted in its 2026 Top Risks report. According to the United Nations, nearly 75% of the world’s population lives in countries classified as “water-insecure” or “critically water-insecure.” Drought, urbanization, and industrial demand are putting growing pressure on fresh water supplies, while much of the infrastructure that delivers water is aging or inadequate. Non-state actors, armed groups, and adversarial governments are increasingly exploiting those vulnerabilities for their own gain.
The risks are particularly acute in Africa, where weak states often struggle to manage scarce resources, and Al Qaeda-linked armed groups in the Sahel have exploited water stress to gain leverage over communities. But the US, despite its wealth, isn’t immune. The American Southwest faces prolonged drought and aging infrastructure, and US water systems are relatively easy to target, according to Nick Kraft, Eurasia Group’s senior analyst for agriculture and water.
The US has roughly 150,000 separate water systems spread across state and local jurisdictions, and many still use basic factory-set passwords on their equipment. Breaching those systems doesn’t require sophisticated hacking. As a result, Kraft says Iran’s cyberattacks on US water systems are “a low-effort way to make a point and get attention, even if the actual damage is minor.”
Water is also one of the few major US infrastructure sectors with no mandatory federal security standards, and the CISA — the federal agency that supports these systems — has lost nearly a third of its staff over the past year, in part because of workforce reductions under the Trump administration.
California offers a glimpse of how those vulnerabilities can become pressure points. In June, the Iran-linked hacking group Handala claimed it had breached California Water Service, the largest water utility in the western US, and posted screenshots of internal systems online. Interestingly, the group said it had deliberately chosen not to disrupt water service. The apparent goal was to show that it could.
Iran’s strategy to bring the war closer to the US. Since the conflict began, Iran-linked hackers have targeted local government systems in Indiana, breached tanker-monitoring systems at gas stations in several states, and hacked a medical equipment supplier, forcing a temporary company-wide shutdown. In March, Handala even breached FBI Director Kash Patel’s personal email, publishing stolen photos and messages.
For Iran, these attacks probably serve to demonstrate reach: Tehran wants to show Americans that a distant war can affect the systems they rely on at home. Attacks on water raise the stakes. Disrupting a government site or a public official’s email causes concern. Threatening the water supply sparks panic.
Iran is no stranger to water risk. Iranian leaders know these vulnerabilities firsthand. Shortly before the war, five years of drought and crumbling infrastructure had pushed cities to the brink of a “day zero” crisis — the point at which water supplies would run out completely. Shortages also fueled public anger at the government and brought hundreds of thousands of Iranians into the streets in January.
Iran also relies on desalination plants for a small share of its drinking water, though far less than its Gulf neighbors. Kuwait, for example, gets roughly 90% of its drinking water from desalination. During the war, several Gulf countries reported Iranian attacks on water infrastructure, while Tehran accused the US of striking its own desalination plants. Such attacks violate international law, which prohibits warring parties from targeting infrastructure civilians need to survive.
Water, then, is both a vulnerability for Iran and a tool it seeks to exploit. As supplies grow scarcer, countries at war and armed groups increasingly have a powerful weapon at their disposal. The attacks in US states appear to have caused little damage, but their message was clear: even turning on the tap is no longer insulated from conflict.
