By the OASSAY Water Safety Team · Last updated: August 2026

In late July 2026, a wave of cyberattacks hit water systems across the United States, marking one of the most widespread digital assaults on American critical infrastructure in recent memory.
According to reporting by The New York Times, at least a dozen states have reported incidents to the F.B.I., with at least 100 municipalities detecting recent malicious hacking efforts targeting their water systems. Federal officials believe the attacks are likely the work of Iranian-linked hackers, though the assessment remains preliminary.
The attacks have not yet resulted in confirmed contamination of drinking water. But they have caused real operational disruptions — reduced water pressure, manual overrides, and precautionary boil-water advisories in affected communities, including Clayton County, Georgia, part of the Atlanta metropolitan area.
Perhaps most concerning: federal cybersecurity agencies disclosed that the hackers had figured out how to disable safety alarms and automatic shutdowns — meaning operators could be looking at screens showing normal readings while something is actively going wrong behind the scenes.

What actually happened?

The short version
Hackers — believed to be affiliated with Iran — gained access to computers that control and monitor water treatment systems across multiple U.S. states. These systems manage critical functions including:

• Chemical treatment levels (such as chlorine dosing used to kill pathogens)
• Water pressure regulation
• Safety monitoring and alarm systems

The attacks exploited a well-known and long-warned-about vulnerability: many of America's approximately 150,000 public water systems — especially smaller, underfunded ones — have minimal cybersecurity protections. In many cases, the control systems were directly accessible via the internet with weak or default login credentials.

This is not new

U.S. intelligence agencies have been warning about this exact scenario for years:

• More than a decade ago, Iranian hackers targeted a small dam in upstate New York
• In late 2023, a hacking group tied to Iran's Islamic Revolutionary Guards Corps briefly took control of equipment at a water utility in western Pennsylvania
• In 2023, the EPA proposed stronger cybersecurity guidelines for water systems — but rescinded the order after Republican-led states and industry groups sued to block it, arguing that smaller utilities couldn't afford to comply
• In April 2026, CISA and other federal agencies issued an urgent public alert about Iranian hackers targeting water, energy, and government infrastructure
• In late July 2026, CISA updated its advisory with additional technical details — and just four days later, the intensified hacking campaign began

As Tatyana Bolton, executive director of the Operational Technology Cybersecurity Coalition and a former U.S. cybersecurity policy official, wrote in a public letter: "To date, we have been lucky that a more catastrophic incident hasn't occurred. We can no longer rely on luck."

Should you be worried about your tap water right now?

What we know

As of early August 2026:

• No water system has been confirmed to have had its drinking water rendered unsafe as a direct result of these attacks
• Several communities have issued precautionary boil-water advisories — not because contamination was confirmed, but because systems were disrupted enough that officials could not guarantee normal water quality
• Federal and local officials have stated that water supplies "remain safe and protected" in most affected areas

What we don't know

• The full scope of the attacks. Officials have said the actual number of compromised systems could be far larger than currently reported. Many small utilities may not even detect intrusions, let alone report them.
• Whether any chemical treatment levels were actually altered. The hackers had access to systems that control chlorine dosing and other treatment parameters. The disabling of safety alarms means that undetected changes are at least theoretically possible, even if none have been confirmed.
• The long-term intent. Cybersecurity experts have described the campaign as potentially "pre-attack staging, not the attack itself" — meaning the access gained could be used for more damaging actions in the future.

Joshua Corman, a critical infrastructure resilience expert at the Institute for Security and Technology, put it bluntly: "The level of access is sufficient for significantly more harm than has been seen."

What could actually go wrong with water treatment?

To understand the real risk, it helps to understand — at a basic level — what municipal water treatment does and what happens if it fails.

How municipal water treatment normally works

Most U.S. municipal water treatment involves several stages:

1. Coagulation and flocculation — chemicals are added to bind with dirt and dissolved particles, forming larger clumps (flocs)
2. Sedimentation — flocs settle to the bottom of a holding tank
3. Filtration — water passes through filters (sand, gravel, activated carbon) to remove remaining particles
4. Disinfection — typically chlorine or chloramine is added to kill bacteria, viruses, and other pathogens
5. pH adjustment and corrosion control — chemicals are added to prevent pipe corrosion (this is directly relevant to heavy metal contamination — see below)
   

What hackers could theoretically disrupt

If a malicious actor gained control of the automated systems managing these processes, they could potentially:

The Flint parallel worth understanding

The Flint, Michigan water crisis (2014–2019) was not caused by hackers. It was caused by a change in water source combined with a failure to apply proper corrosion control treatment. But the mechanism is relevant here:
When water chemistry changes — whether through human error, policy failure, or deliberate manipulation — lead and copper from aging pipes can leach into drinking water at dangerous levels. The EPA estimates that there are still 9.2 million lead service lines in use across the United States.
A cyberattack that altered pH levels or corrosion control chemistry could, in theory, trigger a similar chain of events — and if safety alarms were disabled, it might not be detected quickly.
This is not a prediction. It is a technical possibility that cybersecurity experts have specifically warned about.

What contaminants could be present if water treatment is disrupted?

If municipal treatment were compromised — whether by cyberattack, infrastructure failure, natural disaster, or any other cause — the specific risks depend on what part of the treatment process fails:

Biological contaminants (if disinfection fails)

Chemical and heavy metal contaminants (if corrosion control or treatment chemistry fails)

Sediment and particulates (if filtration or pressure fails)

Backflow events or pressure drops can introduce:

• Dirt, silt, and pipe sediment
• Rust and pipe-scale particles
• Organic matter from soil
  

These particles are not always directly harmful, but they harbor bacteria, reduce the effectiveness of remaining disinfection, and indicate a breakdown in the system's integrity.

How to protect your household drinking water

Whether the current cyberattacks lead to confirmed contamination or not, the underlying reality is clear: U.S. water infrastructure has known vulnerabilities, and the systems that protect your drinking water are not infallible.
Here is what you can do at the household level — not in a panic, but as a reasonable, informed precaution.

Step 1: Pay attention to local advisories

• Sign up for alerts from your local water utility if you haven't already
• Follow your state's Department of Health for boil-water advisories and water quality updates
• If a boil-water advisory is issued: boil water for at least 1 minute (3 minutes above 2,000m elevation) before drinking, cooking, brushing teeth, or preparing food
  

Step 2: Store emergency water
FEMA recommends storing at least one gallon (3.8 liters) per person per day for a minimum of three days. This is your first line of defense against any water disruption — whether caused by a cyberattack, a storm, or a water main break.
Step 3: Understand what home filtration can and cannot do
This is where many people make mistakes. Not all filters address the same contaminants. Here's what you need to know:

Choosing the right water filter: a science-based guide

What you need depends on what you're filtering against
Based on the categories of contamination that could result from a compromised water treatment system, here is what each type of filtration technology actually addresses:
For bacteria and protozoa: hollow fiber membrane filtration
How it works: Water is forced through thousands of tiny hollow fibers with pores small enough to physically trap bacteria and protozoan cysts.
Key specification: pore size

• 0.2 μm — captures most bacteria and protozoa. This is the baseline for credible portable filters.
• 0.1 μm — provides a larger safety margin, particularly for smaller bacteria. This is the current 

recommended standard for high-quality portable and household point-of-use filters.
At 0.1 μm, a hollow fiber membrane filter will capture:

• 99.999% or more of bacteria, including E. coli, Salmonella, Legionella, Campylobacter, and Vibrio cholerae
• 99.9% or more of protozoa, including Giardia cysts and Cryptosporidium oocysts
• Sediment and particulate matter

What it does NOT capture:

• Viruses (too small — typically 0.02–0.04 μm)
• Dissolved chemicals
• Dissolved heavy metals
• Salt

For chemicals, heavy metals, taste, and odor: activated carbon filtration
How it works: Water passes through activated carbon (in block, granular, or fiber form). The carbon's extremely large internal surface area adsorbs dissolved organic compounds, some heavy metals, chlorine, and other chemicals through a combination of physical and chemical bonding.
What activated carbon can reduce:
 ✅ Chlorine and chloramine (taste and odor)
 ✅ Many organic compounds (pesticides, herbicides, some industrial chemicals)
 ✅ Some volatile organic compounds (VOCs)
 ✅ Some disinfection byproducts (THMs)
 ✅ Some heavy metals (lead, mercury — effectiveness varies significantly by carbon type, contact time, and specific product design)
 ✅ Sediment and particulates (if in block form)
What activated carbon generally does NOT address:
 ❌ Bacteria and protozoa (not a reliable barrier)
 ❌ Viruses
 ❌ All heavy metals equally (performance varies)
 ❌ Salt
 ❌ Nitrates
For viruses: chemical disinfection or UV
Most household and portable filters using hollow fiber membranes do not remove viruses, which are far smaller than bacteria. If viral contamination is a concern (which it could be in a scenario where disinfection has failed), consider:

• Chemical disinfection tablets (chlorine dioxide) as a complement to filtration — effective against bacteria, most protozoa, and viruses
• Boiling — effective against all biological pathogens including viruses

The ideal combination for maximum household protection
If you want to protect against the broadest realistic range of contaminants that could result from a water treatment disruption, here's what the science says you need:

The key takeaway: A filter that combines both a hollow fiber membrane (0.1 μm) and an activated carbon stage in a single unit addresses the widest practical range of contaminants — biological, chemical, and aesthetic — in one pass.
Products that integrate both stages into a single cartridge are more practical for everyday and emergency use than running water through two separate devices.

For example, OASSAY's portable filter uses a two-stage composite cartridge that combines carbon fiber with a 0.1 μm PES (polyethersulfone) hollow fiber membrane — addressing bacteria, protozoa, sediment, taste, odor, and some organic compounds in a single unit.

Several under-sink and countertop systems from other manufacturers also offer multi-stage designs, though at significantly larger size and higher cost.
For virus protection specifically, we recommend keeping a supply of chlorine dioxide tablets (such as Aquatabs or Katadyn Micropur) on hand. Used after filtration, they address the viral gap that membrane filters cannot cover.

The bigger picture

The 2026 U.S. water system cyberattacks are not an isolated incident. They are the latest in a pattern that cybersecurity experts have been warning about for years:

• America's water infrastructure is aging and underfunded
• Many of the 150,000 public water systems lack basic cybersecurity protections
• Efforts to mandate stronger protections have been blocked by legal and political challenges
• Foreign adversaries — Iran, China, Russia — have demonstrated both the capability and the intent to target these systems
• The shift from manual operations to internet-connected automated systems has created new attack surfaces

As a consumer, you cannot fix national infrastructure policy. But you can take practical steps to reduce your household's dependence on the assumption that the water coming out of your tap has been treated perfectly, every minute of every day, without interruption or interference.

Sources

The New York Times — "Hacks on U.S. Water Supply Follow Years of Warnings and Neglect" (July/August 2026)
U.S. Environmental Protection Agency (EPA) — Basic Information about Lead in Drinking Water
Federal Emergency Management Agency (FEMA) — Emergency Water Supply Guidelines

OASSAY designs portable water filtration products for outdoor, travel, and emergency preparedness use. Our two-stage composite cartridge combines carbon fiber with a 0.1μm PES hollow fiber membrane, removing 99.999% of bacteria and protozoa while improving taste and reducing organic compounds. OASSAY products are designed as a supplementary layer of protection for freshwater sources and are not a substitute for municipal water treatment or official public health guidance. [Explore OASSAY →]