A coalition of federal agencies is raising alarms about a growing cybersecurity threat aimed at one of the country’s most essential resources: its water systems.

In a joint advisory release, the U.S. Environmental Protection Agency (EPA), Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (NSA) warned that Iranian-affiliated cyber actors are actively targeting U.S. infrastructure—including drinking water and wastewater systems.

The warning comes as some organizations have already experienced system intrusions and operational disruptions. According to the advisory, attackers are exploiting commonly used operational technologies, in some cases interfering with system controls and causing real-world impacts.

The concern is straightforward: when water systems are compromised, the consequences can extend far beyond a temporary outage.

Disruptions could affect treatment processes, damage equipment, or even create openings for contamination. Officials say incidents have already included configuration wiping, tampering with mechanical sensors through software, and interference with human-machine interfaces—the digital systems operators rely on to manage water treatment and distribution.

Beyond the technical damage, there’s also a broader risk to public trust in essential services.

Federal officials emphasize that the water sector remains a particularly attractive target for cyberattacks, given its critical role in public health, the economy, and national security. Communities, hospitals, and businesses all depend on reliable access to clean water, making even limited disruptions potentially far-reaching.

At the same time, agencies stress that many defenses are within reach—even for smaller or under-resourced systems.

The EPA says utilities can significantly improve their cybersecurity posture through practical steps like tightening access controls, updating procedures, and identifying vulnerabilities—often without the need for expensive upgrades. The agency is offering free assessments, technical assistance, and training to help water systems close those gaps.

Officials are also urging organizations to act quickly if they detect suspicious activity. Reporting incidents to federal authorities, including the FBI and CISA, is a key part of both mitigating damage and tracking broader threat patterns.

The advisory is part of a wider push to strengthen cyber resilience across U.S. infrastructure as threats grow more sophisticated and persistent. For water utilities, the message is clear: the risks are no longer hypothetical, and preparation is essential.