EPA links rising attacks on water utilities to unchanged passwords and exposed controls
EPA water chief Jess Kramer says attacks on US water utilities have risen several fold, citing unchanged passwords and system details left online. EPA keeps finding basic weak points, and officials say many utilities lack the staff and investment to close them.
Reality
- Evidence38
- Adoption
- Not scored
- Hype gap+30
- Incentives
- Not scored
- Confidence42
CISA logged more than 100 compromised water systems in July, typically reached through cellular modems
The controllers that failed in July sat on public cellular links, outside the network boundaries utilities spent years hardening, and the only municipal record of those SIMs is a line on a carrier invoice.
Reality
- Evidence40
- Adoption15
- Hype gap+10
- Incentives70
- Confidence45
House bill would authorize $100 million for CISA to buy frontier AI access for critical infrastructure operators
Josh Gottheimer's AI Cyber Defense Act, co-sponsored by two Republicans and two Democrats, would have CISA procure frontier models for small water systems and utilities through 2031. Appropriators still have to fund it.
Reality
- Evidence60
- Adoption8
- Hype gap+12
- Incentives68
- Confidence55
buildOne report1 publisher Colorado water utility intruders changed pumping cycles, disabled alarms; access method undisclosed
Disabling alarms was one of the confirmed operations at two small Colorado water utilities. That puts detection at the front of the review for anyone running a small OT estate.
Reality
- Evidence38
- Adoption25
- Hype gap+8
- Incentives22
- Confidence45
The billion goes to water utilities, local governments and community banks as subsidized Daybreak access rather than cash, so what it costs OpenAI is marginal compute plus support hours, and what it buys is the segment's reference price.
Perspective Coverage
3 publishers
- Builder
- Builder 27%
- Operator
- Operator 48%
- Investor
- Investor 25%
Reality
- Evidence56
- Adoption44
- Hype gap+32
- Incentives74
- Confidence62
FBI names Allen-Bradley MicroLogix PLCs in water intrusions across at least seven states
The bureau and the EPA describe intruders changing IP addresses and switching passwords on internet-facing controllers, and the remedy they list is network design and credentials rather than firmware anyone can ship.
Publishers:fbi.gov
Reality
- Evidence66
- Adoption58
- Hype gap−12
- Incentives38
- Confidence62
CISA logs attacks on more than 100 internet-exposed US water systems in one month
CISA says attackers reached programmable logic controllers over the internet during July 2026, changed IP addresses and passwords, and left some utilities unable to monitor their own equipment. No actor has been named.
Reality
- Evidence58
- Adoption55
- Hype gap+6
- Incentives38
- Confidence52
A dozen states, no marquee targets: the water hacks show where the attack surface actually is
Minnesota's 30-plus plants and the FBI's seven states point at small municipal operators, and at a suspected Iranian campaign that no longer looks opportunistic.
Reality
- Evidence58
- Adoption62
- Hype gap+10
- Incentives55
- Confidence52
A volunteer SOC for 45,000 water systems: what the Water Watch Center asks of operators
DEF CON Franklin and the NRWA are funding small-utility defense with philanthropy and volunteer labor, not appropriations. The arithmetic decides who actually gets helped.
Reality
- Evidence24
- Adoption14
- Hype gap+38
- Incentives58
- Confidence28