Two municipal water systems in New Jersey experienced cyberattacks in the past week, an event state officials are investigating with federal partners, including the FBI and the Cybersecurity and Infrastructure Security Agency. While the specific utilities were not named, the state indicated that the attacks temporarily blinded automated systems, requiring a shift to manual operations.
Officials reported that despite the temporary loss of remote monitoring and management capabilities, there was no disruption to water service, and customers had uninterrupted access to safe drinking water. The New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) is working with the affected utilities and federal agencies to secure the systems and strengthen access controls.
Sources suggest that Iran is considered the prime suspect, potentially as a retaliatory measure. However, authorities are also assessing the possibility that another state actor may be mimicking Iran's tactics to influence U.S. actions. These incidents follow similar attacks on water and wastewater utilities in at least a dozen states, which reportedly exploited a vulnerability in widely used utility software. A fix has been issued, and utilities nationwide are reportedly assessing their systems for potential compromise.
In Georgia, the Clayton County Water Authority briefly issued a boil-water advisory following a cyberattack, and Columbus Water Works also detected an intrusion, though drinking water remained unaffected. Thus far, no illnesses or widespread disruptions to water supplies have been reported, but investigations into the full scope and potential impact of these attacks are ongoing.