Terror threat raises concerns for water and utility security

• DHS warns of cyber and physical threats tied to the Iran conflict.
• Water systems and utilities may be vulnerable to cyberattacks.
• Critical infrastructure remains a top target for Iranian-linked actors.
• Public urged to remain alert and report suspicious activity.

Sunday, June 22, 2025 — A national security bulletin released today by the U.S. Department of Homeland Security warns that the escalating conflict involving Iran is creating a high-risk environment—particularly for critical infrastructure, including public water systems and utility networks. The alert will remain active until September 22, 2025.

According to the bulletin, Iranian government-affiliated cyber actors and hacktivist groups have both the intent and capability to disrupt American systems. “Both hacktivists and Iranian government-affiliated actors routinely target poorly secured U.S. networks and internet-connected devices for disruptive cyber attacks,” the alert stated.

Water Systems: An Unseen Target.

While the advisory covers a range of threats, the implications for the nation’s water sector are serious. Public water systems rely heavily on automated controls and remote network access, features that make them susceptible to unauthorized access or sabotage if not properly secured.

Since the early 2020s, the U.S. Environmental Protection Agency and Cybersecurity and Infrastructure Security Agency have issued repeated warnings about vulnerabilities within the water sector. The new threat bulletin reinforces these concerns, as foreign actors continue to probe for weaknesses in public utilities.

The possibility of a coordinated cyberattack on a water treatment plant, reservoir control system, or rural utility cooperative is not theoretical. In previous years, foreign-based attackers attempted to manipulate chemical levels in water supplies and access supervisory control systems. DHS notes that attackers often seek out “poorly secured U.S. networks” as entry points.

Cybersecurity in the Crosshairs.

The bulletin highlights the likelihood of low-level, ongoing cyber operations aimed at causing disruption or eroding public confidence. These threats come amid existing concerns about aging infrastructure and underfunded cybersecurity programs in many water districts.

While not every cyber event leads to a full-scale attack, even minor breaches can cause confusion, service disruptions, or data loss. According to the advisory, “Low-level cyber attacks against U.S. networks by pro-Iranian hacktivists are likely,” and more organized operations remain a possibility as tensions escalate.

Physical Security Still a Risk.

Although the bulletin’s primary emphasis is cyber threats, it also warns of potential physical attacks on U.S. soil. DHS has tracked increased online activity from groups promoting violence against government-associated facilities, some of which may be interpreted as including public utilities.

Further, if Iranian leadership were to issue a religious ruling calling for retaliation, DHS warns the chances of independent actors launching attacks against targets “linked to the U.S. government or military” could rise. Publicly managed water and power systems, especially those serving military bases or federal agencies, could fall within that scope.

What Water Providers Can Do.

DHS encourages all critical infrastructure operators to remain alert and follow best practices for cyber hygiene. The Cybersecurity and Infrastructure Security Agency offers guidance tailored for utility providers, including recommendations for securing remote access, updating software patches, and monitoring network anomalies.

Operators are urged to report suspicious activity through the Nationwide Suspicious Activity Reporting Initiative or by contacting local FBI field offices and Fusion Centers.

Public Vigilance Encouraged.

The “See Something, Say Something®” campaign remains in full effect, emphasizing community awareness as a frontline defense. Members of the public are encouraged to report any suspicious activity, particularly in or around critical infrastructure facilities, such as water treatment plants, dams, and utility control centers.

For detailed threat information and infrastructure protection resources, visit www.dhs.gov/advisories and www.cisa.gov.

Related posts:

NGWA urges EPA to keep groundwater under state control Court halts Gross Reservoir expansion amid legal storm California first 2025 snow survey shows snowpack near average Showdown emerges over budget and water in Arizona