The water plants that got hacked — what's known and what isn't

Over the last couple of weeks, hackers broke into the systems of several water plants across the United States. The attacks are being blamed on Iranian actors, but the details are still thin. We know the systems got hit. We don't know yet how deep the intrusion went, what data was taken, or whether anything was actually changed in the water that flowed through the pipes.

Water utilities are not Silicon Valley. Most of them run on legacy control systems that were old before half the people reading this were born, patched together by contractors who've moved on, and monitored by small teams that can't afford a 24/7 security desk. That makes them an easy target — low profile, high impact. The attacks line up with a broader pattern of state-sponsored intrusions into critical infrastructure, but the Iranian connection has not been confirmed by any official agency in the public record yet. The FTC and the Department of Energy are looking into it; the story is still developing.

Why this matters for us: if someone can slip into the controls of a water plant, the threat isn't abstract — it hits the people who show up at the sink in the morning and expect the water to be safe.