Iranian Hackers Target US Water and Energy, Washington on Alert
The conflict between the United States and Iran is no longer confined to the Strait of Hormates and military bases in the Middle East. The battle has begun to move into cyberspace, with water networks, telecommunications, energy, and various critical infrastructures within US territory becoming targets of attempted attacks.
NBC News reported on Wednesday, 2 September 2026, that hackers linked to Iran have attempted to breach several American infrastructure systems in recent weeks. The report cited four individuals with access to government and industry information regarding the monitored cyber threats.
So far, these attempts are reported to have not caused major disruptions to public services. However, the existence of these attack attempts indicates that Tehran has the option to expand its retaliation against Washington far beyond American military targets in the Middle East.
The threat is becoming more serious because the hackers’ targets are not merely government websites or office computers. They are reported to be attempting to reach systems that regulate physical processes such as water distribution, energy networks, telecommunications, and automated devices that support daily societal activities.
This development comes as the US-Iran conflict enters a new phase of escalation. President Donald Trump announced on Tuesday, 1 September 2026, that America had launched what he described as a “large and powerful” attack against several Iranian targets around the Strait of Hormuz.
Trump stated that the attack was retaliation for Iran’s attempts to plant sea mines in that strategic waterway and missile attacks against a US base in Jordan. He also warned Iran that it would be “hit at a much harder and higher level” if Tehran retaliates.
In such a situation, cyberattacks offer a form of conflict very different from missiles and drones. Attacks can be launched from thousands of kilometres away, are difficult for the public to detect, and in some cases, are more complex to immediately attribute to a specific nation.
Water, Energy, and Telecommunications
Recent reports mention that water systems, telecommunications, energy networks, and other infrastructure are among the targets being attempted. The attackers are said to be seeking automated devices connected to the internet that have access to the operational processes of a facility.
Such devices are commonly referred to as part of operational technology, or OT. One of the most critical components is the programmable logic controller, or PLC—industrial computers that can control pumps, valves, production machinery, safety alarms, and various other automated processes.
This technology is essentially designed to facilitate the operation of industrial facilities. However, when a PLC is directly accessible via the internet without adequate security systems, the device can also become an entry point for attackers.
The US government had actually warned of this risk long before the latest wave emerged. CISA, along with the FBI, NSA, Department of Energy, Environmental Protection Agency, and US Cyber Command, warned in April 2026 of activity by Iranian-affiliated cyber actors against internet-connected industrial control devices.
The warning identified the water sector, public facilities, and energy as several targets that needed to increase vigilance. The US government subsequently updated its advisory in July after activity against these devices was deemed to be continuing to evolve.
This means that the current threat is not entirely a new phenomenon resulting from American military strikes in September. US infrastructure devices have been targets of reconnaissance and penetration attempts for months before the latest escalation broke out.
Over 100 Water Systems Targeted
One of the sectors receiving the most attention is the water and wastewater system sector. CISA revealed at the end of August that more than 100 internet-connected systems in that sector were targets of malicious cyber activity throughout July.
Many of the targeted devices were PLCs connected via cellular modems or direct internet connections. This condition allows operators to manage systems remotely, but simultaneously expands the attack surface for hackers.
The wave of attacks was reported to target facilities across various US states. Minnesota was one of the regions that drew attention after dozens of local water systems were reported to be targets within a close period.