THE APEX TIMES
FBI and EPA warn of reported cyberattacks on municipal water systems in at least seven states, after reports of degraded operations
A joint warning issued by federal law enforcement and the Environmental Protection Agency described water-system cyber incidents reported across multiple states, and said some malicious activity degraded water operations while the FBI declined to identify the affected jurisdictions.
Federal investigators and the Environmental Protection Agency warned as of August 2, 2026 that cyberattacks affecting municipal water systems were reported across at least seven states, according to a joint public service announcement described in reporting circulated Tuesday.
The announcement, as characterized by Zero Hedge, said the FBI and the EPA had received reports of malicious activity targeting water operations and, in some cases, that the incidents degraded water operations. The agencies reportedly did not name the states publicly in the warning.
The same reporting said the FBI declined to provide additional public details about the affected states, including in response to requests for identification of where the attacks occurred. The joint PSA also reportedly emphasized the public-safety implications of compromises to drinking water systems.
President Donald Trump was also referenced in the reporting, which said Trump “shot down” an Iran-related theory about responsibility for the attacks. The details of what evidence, if any, was cited publicly were not included in the available record beyond the characterization in the account.
Because the central elements of the case are described through secondary reporting, additional details such as the precise timeline of the incidents, the specific water utilities involved, and the specific methods or indicators of compromise were not included in the available material. A full verification of the PSA text and any accompanying agency statements is needed before publishing.
If the joint PSA reflects an active federal coordination effort, the practical stakes include continuity of water treatment operations, protection of critical infrastructure against repeat intrusions, and clarity on how local utilities and state agencies are expected to respond when federal investigators issue broad threat notices.
The FBI and EPA warning, as described, is the primary basis for the public timing and scope reported here. Further updates from the agencies could include additional technical guidance, recommended steps for utilities, and eventual identification of affected jurisdictions if the investigation allows it.
Why It Matters
- Municipal drinking water systems are critical infrastructure, and public federal threat notices can shape how utilities prioritize detection, monitoring, and incident response.
- Broad warnings without jurisdiction-level identification can complicate local planning and public communication, increasing the need for clear utility and state coordination.
- If federal investigators determine that operational degradation occurred, the incidents raise questions about safeguards in water treatment and distribution controls.
- A dispute over publicly floated theories of attribution highlights how agencies handle evidence and communication during active cyber investigations.
- Additional technical and procedural guidance from federal agencies would be a key next step for utilities and state partners to reduce the risk of follow-on attacks.
Key Facts
- Reporting described a joint public service announcement involving the FBI and the Environmental Protection Agency about cyberattacks affecting municipal water systems reported in at least seven states.
- The warning, as described, said some malicious activity degraded water operations.
- The FBI reportedly declined to identify the states affected by the incidents in the public-facing warning.
- The reporting also said President Donald Trump rejected an Iran-related theory about responsibility for the attacks.
- The underlying details of the incidents, including specific jurisdictions and utilities, were not provided in the available material beyond the reported seven-state scope.