Cyberattacks Target New Jersey Water Systems, Iran Suspected as Prime Culprit
Two municipal water systems in New Jersey were hit by cyberattacks last week, temporarily disabling automated monitoring and forcing operators to switch to manual controls. The state’s Cybersecurity and Communications Integration Cell (NJCCIC) confirmed the incidents on Wednesday, revealing that the attacks exploited vulnerable internet-exposed control systems. While service remained uninterrupted, both utilities have since implemented stronger access controls.
The NJCCIC, working alongside the FBI and the Cybersecurity and Infrastructure Security Agency (CISA), determined that the breaches did not disrupt water supply or safety, with customers maintaining access to safe drinking water. Sources indicate Iran is the leading suspect, potentially in response to escalating U.S. tensions, though officials are also investigating whether another state actor may have mimicked Iranian tactics to influence U.S. actions.
The attacks follow similar incidents in Georgia, where the Clayton County Water Authority briefly issued a boil-water advisory after a hack, and Columbus Water Works detected an intrusion without impact to drinking water. Nationwide, at least a dozen water and wastewater utilities have been targeted, exploiting a vulnerability in widely used utility software. A patch has been released, but utilities are scrambling to assess potential breaches.
No illnesses or widespread disruptions have been reported, though authorities continue to evaluate the full scope of the attacks and their potential impact on critical infrastructure.
Columbus Water & Power cybersecurity rating report: https://www.rankiteo.com/company/columbus-public-utilities
"id": "COL1786832852",
"linkid": "columbus-public-utilities",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"{'affected_entities': [{'industry': 'Water and wastewater utilities',
'location': 'New Jersey, USA',
'type': 'Municipal water system'},
{'industry': 'Water and wastewater utilities',
'location': 'Georgia, USA',
'name': 'Clayton County Water Authority',
'type': 'Water authority'},
{'industry': 'Water and wastewater utilities',
'location': 'Georgia, USA',
'name': 'Columbus Water Works',
'type': 'Water authority'}],
'attack_vector': 'Internet-exposed control systems',
'description': 'Two municipal water systems in New Jersey were hit by '
'cyberattacks last week, temporarily disabling automated '
'monitoring and forcing operators to switch to manual '
'controls. The attacks exploited vulnerable internet-exposed '
'control systems. While service remained uninterrupted, both '
'utilities have since implemented stronger access controls.',
'impact': {'operational_impact': 'Forced switch to manual controls',
'systems_affected': 'Automated monitoring systems'},
'investigation_status': 'Ongoing',
'motivation': 'Potential response to escalating U.S. tensions',
'post_incident_analysis': {'corrective_actions': 'Implementation of stronger '
'access controls, patch '
'deployment',
'root_causes': 'Vulnerable internet-exposed '
'control systems, unpatched '
'software'},
'references': [{'source': 'NJCCIC'}, {'source': 'FBI, CISA'}],
'response': {'containment_measures': 'Stronger access controls implemented',
'law_enforcement_notified': 'Yes',
'remediation_measures': 'Patch released for vulnerability',
'third_party_assistance': 'FBI, CISA'},
'threat_actor': 'Iran (suspected)',
'title': 'Cyberattacks Target New Jersey Water Systems',
'type': 'Cyberattack',
'vulnerability_exploited': 'Vulnerability in widely used utility software'}