Iranian Hackers Are Now Inside American Water and Energy Control Systems, US Warns

The U.S. government says Iranian state-backed hackers are actively breaking into the control systems that run American water and energy utilities, and in at least one case they've already tampered with safety mechanisms designed to prevent accidents.

An advisory updated Wednesday by the FBI, the NSA, the Department of Energy, and CISA (the Cybersecurity and Infrastructure Security Agency) lays out the details. The hackers are going after programmable logic controllers, the small industrial computers that manage physical processes like valves, pumps, and pressure systems at critical infrastructure sites. Break into one of these, and you can alter what shows up on an operator's screen, trigger outages, or worse, hide the fact that something has gone wrong.

That last part isn't hypothetical. According to the FBI, hackers got into at least one critical infrastructure provider and rewrote the controller's programming logic to disable the processes responsible for critical shutdowns and alarms. The result, in the agencies' words, was that "systems to enter unsafe conditions without notifying operators of the anomalies." In plain terms: the safety net that's supposed to catch a malfunction and alert a human being was quietly switched off.

From one vendor to an entire category of equipment

This campaign isn't brand new. Earlier this year, investigators traced the initial wave of attacks to controllers made by Rockwell Automation, a major industrial equipment maker. Wednesday's update widens the scope considerably, adding Schneider Electric and Siemens hardware to the list of targeted systems. Both companies make industrial control equipment used widely across water treatment plants, power utilities, and manufacturing facilities in the U.S. and globally.

The agencies went further, warning that "potentially all internet exposed" industrial control systems could be at risk, not just the specific product lines named so far. That's a meaningfully broader warning than the original alert, and it's why the government is now pushing critical infrastructure operators to take defensive action rather than assuming the threat is confined to one brand of equipment.

The advisory attributes the motive directly: the hackers are, in the agencies' assessment, "conducting this activity to cause disruptive effects within the United States." The likely trigger is the ongoing conflict involving Iran, the U.S., and Israel, which began in February and has since spilled into cyberspace in ways that go well beyond traditional espionage.

A pattern that's escalated since February

This water and energy advisory doesn't exist in isolation. It's the latest entry in a string of Iranian-linked cyber incidents that have hit American and regional targets since the war started, and the character of those incidents has been shifting.

Some of it looks like classic state-sponsored espionage: hack-and-leak operations designed to embarrass or expose. One example cited in the advisory's broader context is the leak of contents from FBI Director Kash Patel's personal email account.

But a good chunk of the recent activity has been more aggressive, aimed at causing real damage rather than just stealing secrets. Medical technology company Stryker was hit by an Iranian group calling itself "Handala," which managed to remotely wipe tens of thousands of employee devices. That's not espionage, that's sabotage with an immediate, tangible cost to the victim organization.

Handala also claimed responsibility for a data breach at Cal Water, a California water provider, back in June, asserting it could have disrupted the water supply. Cal Water pushed back on the severity of that claim, saying it found no evidence that the hackers had actually gained access to the operational networks that control water delivery, as opposed to other, less sensitive systems.

Why this one is different

Water and energy systems sit in a different category from a hospital network or a corporate IT breach, because the failure mode isn't just data loss. It's physical: a manipulated controller can mean a plant runs unsafely without anyone realizing it until something breaks. That's precisely the scenario the FBI describes having already happened once.

The expansion to Schneider Electric and Siemens equipment matters because those companies' controllers are everywhere, not just in water and power utilities but across manufacturing and other industrial sectors that rely on the same categories of internet-connected hardware. A vulnerability or attack technique that works against one vendor's PLCs doesn't necessarily transfer to another's, but a campaign broad enough to hit three major manufacturers suggests the attackers are either finding common weaknesses across internet-exposed systems generally, or have simply widened their target list opportunistically.

For infrastructure operators, the advisory functions as a direct instruction: assume your internet-connected control systems are a target, not just a theoretical risk. For everyone else, it's a reminder that a geopolitical conflict happening thousands of miles away is now showing up in the software that keeps American water flowing and power running, with federal agencies confirming that at least one operator has already had its safety systems quietly disabled by a foreign adversary.