Signal US Water System Cyberattacks Spread to Georgia and Michigan, Now Affecting a Dozen States

Summary

Cyberattacks against US water and wastewater utilities, first reported affecting at least seven states since July 27, 2026, spread further to Georgia and Michigan by August 3, 2026, The Register reported, with a subsequent Axios report on August 4 putting the total number of affected states at 12. Georgia confirmed attacks to ABC News but reported limited damage, while Michigan reported hostile cyber activity at nine water systems with no operational disruptions or public health impacts. Security researchers at Tenable suspect the Iran-affiliated CyberAv3ngers group based on similarities to prior IRGC-linked campaigns, though the FBI has not publicly attributed the incidents; the FBI said it has observed activity targeting Rockwell Automation/Allen-Bradley programmable logic controllers specifically. Minnesota Governor Tim Walz attributed the attacks to Iran and cited inadequate cybersecurity funding, while President Trump publicly rejected the Iran attribution without providing evidence and instead criticized Minnesota's governor. No water supplies have been reported unsafe to drink, and Michigan officials stated all systems continued to operate safely.