Iranian-linked hackers target U.S. water utilities through exposed industrial controllers

Iranian-affiliated actors have hacked water utilities across roughly a dozen U.S. states since late July 2026, targeting programmable logic controllers exposed online. CISA flagged this vector in April. America has 150,000+ public water systems, mostly small towns without security staff. The fixes are technically simple; the barrier is organizational, and it has persisted for years.