From the article:

According to a joint alert from the FBI and the Environmental Protection Agency, “malicious cyber actors” have been remotely tampering with some water systems’ internet-connected programmable logic controllers, or PLCs, causing loss of water pressure and flooding.

The warning, issued Thursday, comes after U.S. intelligence officials said Iran was likely behind a coordinated cyberattack on more than 30 municipal water systems in Minnesota. Experts have also warned for years that U.S. water industry, which has resisted regulation efforts, has been vulnerable to cyberattacks.

Intelligence agencies have not definitively concluded that Tehran was responsible for the disruptions in Minnesota, but the hack follows urgent warnings by federal cybersecurity officials that Iran for months has been targeting internet-exposed devices that control operations at water, wastewater and energy facilities in the U.S. In July, federal cybersecurity authorities specifically warned that Iranian hackers were exploiting vulnerable PLCs.

President Donald Trump has blamed Minnesota’s government, not Iran, for that attack. The FBI did not respond to request for comment Friday about whether it believed Iran was responsible, saying the agency and others were “fully engaged to protect critical infrastructure.”

The Post reported Thursday that intrusions have been noted at several water and energy systems across the country since shortly after the war began on Feb. 28.

Federal authorities have not identified which states were affected in recent hacks. Outside of Minnesota, Michigan and South Dakota have also reported attacks. However, experts said it is likely many more states are affected, given that the brand of PLCs targeted — Rockwell Automation/Allen-Bradley — is widely used.

[...]

A July 22 advisory issued by the Homeland Security Department’s Cybersecurity and Infrastructure Security Agency noted that the FBI and CISA have observed Iranian hackers tampering with the PLC’s logic software, “allowing systems to enter unsafe conditions without notifying operators of the anomalies.”

[...]

Experts widely agreed that water infrastructure in the United States has been uniquely vulnerable for more than a decade. Of the roughly 151,000 water plants in the United States, about one-third service residential communities year-round. But only about 420 water plants participate in WaterISAC to try to improve cybersecurity across the water sector.

[...]

Compounding the problem, the water industry has also resisted efforts to be regulated for cybersecurity. After the Biden administration tried to impose cybersecurity audits of water utilities in 2023, some water industry groups and three states — Missouri, Arkansas and Iowa — sued, causing the EPA to roll back its standards.