Nine water and wastewater systems across Michigan have been hit by what federal investigators describe as a coordinated campaign of hostile cyber activity, prompting an FBI-led investigation into intrusions that reached the operational technology controlling pumps, valves and treatment processes. The targeting did not, according to state officials, compromise drinking water or cause a public health emergency — but the incident has exposed how exposed some of the country's most essential infrastructure remains, and it has drawn fresh attention to the question of who was behind it.
As of September 22, 2026, no US agency has publicly named a perpetrator. Reporting based on US intelligence and investigative sources has identified Iran-affiliated actors as the leading suspect, an assessment that officials have not confirmed on the record and that remains preliminary. That gap between what investigators reportedly suspect and what the government has formally stated is now central to how the story is unfolding.
What we know so far
According to Michigan's Department of Environment, Great Lakes, and Energy (EGLE), nine water systems in the state were targeted. The state has characterised the activity as consistent with a federal warning about attempts to tamper with operational technology — the industrial control systems that run physical equipment rather than the office networks where ransomware attacks usually land.
EGLE has said that all affected systems continued to operate safely, that local operators addressed the issues, and that there were no known impacts posing a public health concern. That distinction matters: a cyber intrusion into a water utility is not the same thing as contamination of the water supply or an outage in service. Michigan officials have been careful to separate the two.
The FBI is leading the federal investigation, supported by the Cybersecurity and Infrastructure Security Agency (CISA), the Environmental Protection Agency (EPA) and state authorities. The bureau has said it is aware of public reporting about incidents affecting the water and wastewater sector and that it and its interagency partners are engaged in protecting critical infrastructure — language that acknowledges the activity without resolving the attribution question.
The available public record does not identify a specific FBI case agent, field office, or named bureau official overseeing the Michigan investigation, and no charging documents or formal attributions have been released. Nor does the public reporting establish that every affected Michigan system used the same equipment or that a single technical method was used in every incident.
How the intruders got in
The campaign appears to have focused on internet-facing programmable logic controllers, or PLCs — industrial computers used to control pumps, valves, pressure, chemical treatment and related processes. Federal warnings described malicious actors remotely accessing these devices.
According to the FBI's warnings, attackers could change PLC internet addresses, alter passwords, disable or interfere with alarms, cause pressure loss, and contribute to flooding or other operational disruption. Several of those actions are less about stealing data than about manipulating the physical world: a pump that will not start, a valve that opens when it should not, or an alarm that stays silent while pressure drifts out of range.
A federal advisory updated on July 22, 2026 warned that Iran-affiliated actors were targeting Schneider Electric, Siemens and potentially other PLC brands across US critical infrastructure. That advisory, supported or issued with CISA's involvement, has provided much of the technical scaffolding for how utilities have interpreted the subsequent incidents.
It is worth being precise about what that means. Public reporting does not establish that every targeted Michigan system used one of the brands named in the advisory, nor that a single actor or a single tool was responsible for all nine incidents. Security advisories describe patterns and capabilities; they do not, by themselves, prove that a particular intrusion followed the playbook they describe.
Why water utilities are a soft target
Water and wastewater systems occupy an awkward position in the landscape of American critical infrastructure. They are numerous — tens of thousands of utilities serve communities across the country — and the great majority are small, run by municipalities with limited budgets and even more limited cybersecurity staff. Many have historically prioritised reliability and regulatory compliance over network defence.
At the same time, the technology that runs them has become more connected. PLCs and other operational technology devices were once largely isolated from the public internet. Over years of modernisation, remote monitoring and remote maintenance have become common, and with them, internet-facing connections that can be discovered and probed from anywhere.
The FBI's warnings specifically flagged internet-facing PLCs — a reminder that the threat is not necessarily exotic. In some cases, exposure comes down to a device that should never have been reachable from outside the plant.
The consequence of that exposure is heightened because operational technology sits close to the physical process. On an office network, a compromised machine is a data problem. On a plant floor, a compromised controller is a plumbing problem — and in a water system, physical consequences can reach the public in ways that are hard to reverse quickly.
The counterweight, officials have stressed, is that these systems are also engineered with layers of manual control, redundancy and on-site oversight. Michigan's account of the nine incidents — local operators detecting and addressing issues, service continuing, no public health impact — fits that picture. Utilities are not defenceless; they are simply unevenly defended.
The attribution question
US officials reportedly regard Iran-affiliated actors as the leading suspect. That reporting is based on intelligence and investigative sources rather than a public finding. The FBI has not publicly attributed the attacks to Iran or to any specific group as of September 22, 2026.
There are sound reasons for that caution. Attribution in cyber operations is technically difficult, politically consequential and slow. Investigators weigh infrastructure used in an attack, malware code, targeting patterns, and intelligence that may never be releasable. Naming a state sponsor carries diplomatic and legal weight, and agencies generally prefer to be certain before they do so.
There is also a doctrinal question. Even if a campaign is traced to actors associated with a particular country, governments must decide whether to describe it as state-directed, state-tolerated, or the work of individuals operating in a permissive environment. Those distinctions shape what response, if any, follows.
For now, the mismatch between anonymous reporting and official silence leaves the public with an incomplete picture. That is not unusual in cyber investigations, but in this case it applies to infrastructure that millions of people rely on daily.
Beyond Michigan: a wider campaign
The activity was not confined to one state. It initially involved at least seven states and was later reported across at least twelve, although the precise national total and the number of systems affected have varied by source and over time.
That variability is itself a feature of the story. Early reporting on cyber campaigns against critical infrastructure often produces shifting numbers as utilities, state agencies and federal investigators reconcile what they have seen. Some incidents turn out to be probes rather than intrusions; some are counted twice; some emerge only after a second look at logs.
What has been consistent is the sector: water and wastewater. That pattern, repeated across multiple states, is what led federal agencies to treat the incidents as related rather than a series of unrelated events, and it is a large part of why the FBI is leading a coordinated investigation rather than leaving each case to local authorities.
The federal response
CISA's role in the response has been primarily defensive. The agency has shared indicators, worked with utilities to reduce exposure, and helped coordinate incident response alongside federal, state and local partners. Its advisories on Iranian-affiliated activity against PLCs and critical infrastructure form part of the public record utilities have been asked to act on.
The EPA, which holds federal responsibilities related to the water sector, has participated in the interagency response and warnings. Public reports have cited both the EPA and the FBI as investigating or coordinating around incidents in multiple states.
Michigan's EGLE received the federal alert and gathered reports from affected communities, confirming that nine systems were targeted and that they remained safe and operational. The Michigan State Police has also been engaged in the state-level response. The available search material does not provide a full account of the state police's specific role, and a journalist should confirm those details directly with the agency before publication.
At the local level, the burden has fallen on plant operators — the people who noticed something wrong, reported it, and kept water flowing. Their work is largely invisible in a story measured in advisories and agency statements, but it is the reason the public impact has so far been described as nil.
What it means for the public
For residents of the affected communities, the practical message from state officials has been reassuring: the water remained safe to drink, service continued, and there was no known public health impact. Nothing in the public record contradicts that.
The less reassuring message is structural. The campaign demonstrated that hostile actors can, at least in some cases, reach the systems that control physical water infrastructure. Even where they fail to cause harm, the attempt carries value for an adversary: it imposes cost, generates anxiety, and forces defenders to spend scarce resources on response rather than improvement.
There is also a cumulative effect. Repeated campaigns against different sectors normalise a threshold of hostility that would have been extraordinary a decade ago. Each incident that ends without harm makes the next one easier to absorb — and potentially easier to under-resource.
What happens next
Several threads will determine how this story develops.
The first is attribution. Whether the FBI moves from awareness to a named finding will shape everything downstream, from sanctions to diplomacy to how utilities calibrate their defences.
The second is technical disclosure. Federal advisories have already described the broad methods — remote access to internet-facing PLCs, tampering with addresses, passwords and alarms. Further detail, if released, would help utilities check whether their own equipment matches the pattern.
The third is remediation. The advisory updated in July 2026 identified specific product lines as targets. Utilities running those systems will be under pressure to inventory internet-facing devices, remove unnecessary exposure, and strengthen monitoring of operational technology. For small systems, the question is whether they have the money and staff to do it.
The fourth is oversight. Cyberattacks on water infrastructure sit at the intersection of national security, environmental regulation and municipal governance, and multiple congressional committees have historically taken an interest in the sector's preparedness. Whether this campaign prompts legislative attention remains to be seen.
The bigger picture
Michigan's nine affected systems are, in one sense, a success story: intrusions were detected, operators responded, and the taps kept running. But the episode also illustrates a persistent asymmetry in critical infrastructure defence. Attackers need to find one exposed controller. Defenders need to find every one.
The FBI's investigation is ongoing, and no public attribution has been made. Until that changes, the most accurate description of the situation is a carefully bounded one: a multi-state campaign against water sector operational technology, a nine-system impact in Michigan, no known harm to public health, and a leading suspect that officials have not yet been willing to name.
For the utilities involved, the work of hardening these systems continues regardless of how the attribution question resolves. For everyone else, the campaign is a reminder that the most consequential cyber threats are not always the ones that steal the most data — sometimes they are the ones that reach for the valves.