Cyberattacks on America’s drinking water and wastewater systems have risen sharply in recent years, and the nature of the threat is changing, senior Environmental Protection Agency officials told Fox News Digital. Rather than simple ransomware schemes aimed at extorting money, hackers are increasingly trying to disrupt the systems themselves.
“There is definitely been an increase, several fold on attacks recently,” said EPA Assistant Administrator for Water Jess Kramer. “You’re seeing everything from failure to change password, leading to cyberattacks all the way to … system specifics being available online.”
Kramer said the stakes are high precisely because water infrastructure is woven into every part of daily life. “Our everyday life completely crumbles without access to drinking water and wastewater infrastructure,” she said. “Everything from hospitals to daycares, everything that we care about and need on an everyday basis can be impacted” if an attack succeeds.
Aging Systems, Thin Defenses
EPA Assistant Administrator for Enforcement and Compliance Assurance Jeff Hall said many utilities remain exposed because they run old equipment without the money or staff to secure it properly. “We will see water systems left vulnerable to cyberattacks where there have not been significant amounts of investment in cybersecurity protocols,” he said, citing missing basics like virtual private networks and firewalls.
Hall said hackers have “moved from ransomware attacks designed to extort payments from critical infrastructure generally to more specific attacks designed to disrupt critical infrastructure and particularly water and wastewater systems.” Increasingly, he said, attackers are “manipulating the human-machine interface to change critical settings which disrupts the service and also puts people at risk.”
Minnesota and Colorado Incidents
The warnings follow real-world breaches. In July, a coordinated cyberattack hit more than 30 community water systems across Minnesota, disrupting the technology utilities use to remotely monitor and control equipment. More recently, Colorado officials disclosed that foreign actors breached two small water utilities and manipulated equipment used to control drinking water systems. Officials said drinking water remained safe in both cases.
Unlike breaches that mainly expose personal data, successful intrusions into water systems can interfere with services that touch nearly every corner of daily life — hospitals, schools, manufacturing, emergency services and ordinary households — a vulnerability that has drawn increasing attention from national security officials.
Basic Vulnerabilities, Growing Sophistication
Kramer said workforce shortages compound the problem, making it harder for utilities to hire and keep staff capable of defending increasingly complex networks. Since 2025, the EPA has identified more than 900 cybersecurity vulnerabilities at water systems nationwide. Kramer said the most common issues include “failure to change passwords, lack of multi-factor authentication” and critical system information that is “easily accessible” online.
Hall said the EPA and its law enforcement partners have also issued advisories about weaknesses in programmable logic controllers and other industrial control systems that run pumps, valves and other equipment inside water facilities. “There are aging infrastructure that is embedded in these drinking water systems,” he said. “It’s often left open to the open internet and not protected by any specific firewalls or virtual private networks that would ensure that cyber attackers cannot easily manipulate those.”
Hall said the agency is tracking a range of adversaries, including state-affiliated actors, hacktivist networks and insider threats. “There are certainly state affiliated actors targeting water and wastewater systems,” he said.
Progress, But Gaps Remain
Both officials said utilities are addressing many common weaknesses, though Kramer acknowledged it’s hard to measure nationwide progress because the EPA cannot require every water system to report cyber incidents. Hall said agency inspectors review cybersecurity planning at larger drinking water systems while the EPA’s Office of Water offers training and direct technical assistance to smaller utilities.
“We are seeing an increase in the number of systems that are addressing their basic vulnerabilities,” Hall said. “But … there are real concerns that cyber attackers are going up to the next level and that there are still a lot of vulnerabilities out there that we will have to be addressing.”
