As geopolitical tensions between the United States and Iran escalate following military developments in the Middle East, U.S. cybersecurity agencies have issued urgent warnings about Iranian hackers actively targeting critical infrastructure, with a particular focus on water and wastewater utilities. The campaign represents a concerning expansion of Iranian cyber operations from their traditional targets of defense contractors and government systems toward civilian infrastructure with potential public health implications.

Water utilities have been identified by security researchers as particularly vulnerable targets within critical infrastructure. Unlike electric utilities and telecommunications companies, which have faced sustained cyber threats for over a decade and have correspondingly invested in security capabilities, many water systems remain underprotected. The sector is characterized by aging operational technology — industrial control systems often running decades-old software — modest budgets, and security teams that may lack dedicated cybersecurity expertise.

The potential consequences of a successful cyberattack on water infrastructure range from service disruption to scenarios with genuinely dangerous public health outcomes. Industrial control systems at water treatment facilities regulate the addition of chemicals — most notably chlorine and other disinfectants — to water supplies. In 2021, a widely-publicized incident at a Florida water treatment plant demonstrated that an attacker who gained access to control systems could attempt to alter chemical concentrations to dangerous levels. More sophisticated attacks could disrupt pumping operations across large utility service areas.

The CISA and EPA have published joint advisories urging water utilities to implement immediate protective measures, including network segmentation between IT and operational technology networks, multi-factor authentication for all remote access, and elimination of internet-connected control system interfaces where possible. The agencies have also offered free cybersecurity assessment services to utilities that may lack the resources to conduct their own evaluations.

The targeting of civilian water infrastructure reflects a doctrine of deliberately increasing the societal cost of geopolitical confrontation — making civilian populations feel the consequences of government policy decisions. This approach, while not unique to Iran, represents an escalation that international cybersecurity norms have historically sought to prohibit. The incidents are driving urgent policy discussions about whether existing international agreements on critical infrastructure protection need to be strengthened and what consequences should flow from their violation.