Iranian-linked water utility hacks exploit a structural gap: 150,000 systems, minimal defenses

Iranian-affiliated actors struck water utilities across roughly a dozen U.S. states since late July 2026, targeting internet-exposed PLCs. The vector is well-known: CISA flagged it in April. The U.S. has 150,000+ public water systems, mostly small municipalities lacking security staff. CISA's fixes — inventory PLCs, restrict OT access — are technically simple. The barrier is organizational, and it has persisted for years.