Loading story…
Senators Adam Schiff and Amy Klobuchar introduced a comprehensive cybersecurity bill aimed at strengthening protections for U.S. water infrastructure after recent cyberattacks on water systems. The legislative push follows longstanding federal concern over the sector’s weak cyber posture, including a GAO finding that the EPA urgently needs a strategy to address cybersecurity risks across water and wastewater systems, underscoring gaps in oversight, coordination, and resilience for a critical public service.
The move comes as sector-specific defenders continue to warn utilities about exploitable flaws in widely used technology. WaterISAC highlighted several high-priority vulnerabilities for water and wastewater operators, including CVE-2026-8037 in Progress LoadMaster (unauthenticated OS command injection leading to remote code execution), CVE-2026-68820 in Microsoft Windows (privilege escalation), CVE-2026-72898 in Metabase (SQL injection that can enable unauthenticated administrator access), and CVE-2026-19516 in Grafana MCP Server (server-side request forgery), noting that multiple issues are listed in CISA’s Known Exploited Vulnerabilities catalog.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
WaterISAC issued its TLP:CLEAR "Weekly Vulnerabilities to Prioritize – August 13, 2026" bulletin, highlighting high-priority flaws affecting widely used products relevant to water and wastewater utilities.
Sens. Adam Schiff and Amy Klobuchar released a comprehensive cybersecurity bill in response to recent cyberattacks on water infrastructure, according to a Senate press release.
GAO published a report titled "Critical Infrastructure Protection: EPA Urgently Needs a Strategy to Address Cybersecurity Risks to Water and Wastewater Systems," identifying the need for a federal strategy to address cyber risks in the water sector.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
waterisac.org
Open sourceschiff.senate.gov
Open sourcegao.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New York has expanded its effort to protect drinking water and wastewater systems by pairing statewide cybersecurity requirements with more than **$9 million** in SECURE grant funding for **153** utilities. State officials said the program supports cybersecurity assessments, security upgrades, operator training, incident reporting, and risk-based protections, while requiring larger drinking water systems to designate cybersecurity leads. The initiative builds on regulations issued by the Departments of Environmental Conservation and Health and is administered through the Environmental Facilities Corporation with technical assistance for local communities. The funding push comes as U.S. water infrastructure faces heightened operational technology threats. A recent multistate campaign targeted more than 30 community water systems in Minnesota, with additional incidents reported in at least seven states including Michigan, South Dakota, and Georgia. Federal investigators have not formally attributed the activity, but Iran is considered a leading suspect because the tactics resemble earlier operations against industrial control systems and water utilities. In response, **CISA** urged operators to remove internet-exposed PLCs and strengthen remote access and password security.
Aug 5, 2026
U.S. policymakers are advancing new cybersecurity measures for the **water and wastewater sector**, with separate federal and state initiatives aimed at improving defenses for under-resourced utilities. A bipartisan federal proposal, the **FLOWS Act**, would provide the Environmental Protection Agency with **$50 million annually** to help small and rural water systems modernize cybersecurity capabilities, digital monitoring, and operational technology support without requiring local cost sharing that often blocks access to federal aid. In New York, state officials finalized what they describe as **first-of-its-kind cyber mandates** for public water systems and paired them with a **$2.5 million grant program** to support risk assessments and security upgrades. The rules establish enforceable requirements for drinking water and wastewater operators to create formal cybersecurity programs, identify risks, and implement technical safeguards for operational systems, reflecting broader concern that the water sector remains a comparatively weak point in U.S. critical infrastructure security.
Jun 30, 2026
Hackers associated with China have gained unauthorized access to the IT networks of hundreds of small and medium-sized water utilities and other critical infrastructure providers across the United States. These intrusions are believed to be part of a broader strategy to position Chinese actors to sabotage American water and power supplies in the event of a geopolitical conflict, particularly if tensions escalate over Taiwan. U.S. officials have been aware of this threat for over two years, and recent reporting has brought renewed attention to the scale and persistence of these cyber operations. The targeted utilities are often located in rural areas and small towns, which typically lack the cybersecurity resources and expertise of larger metropolitan systems. The operational technology (OT) systems that control water treatment and distribution are especially vulnerable due to their increasing automation and remote accessibility. The risk is compounded by a significant resource gap, as many of these utilities struggle to defend against sophisticated nation-state threats. Efforts to bolster defenses have included the launch of two non-profit initiatives aimed at supporting critical infrastructure operators, but these programs face their own limitations. One of the non-profits has paused its activities to recalibrate its approach, while the other is only able to provide assistance in a limited number of states due to resource constraints. The threat underscores the broader challenge of protecting critical infrastructure in the United States, where many essential services are managed by small organizations with limited budgets. The potential for cyber sabotage of water and power systems raises concerns about the resilience of civilian infrastructure in the face of international conflict. U.S. government agencies have issued warnings and guidance to utilities, but implementation of robust security measures remains inconsistent. The situation highlights the need for increased investment in cybersecurity for critical infrastructure, particularly in rural and underserved areas. The ongoing threat from Chinese-linked hackers demonstrates the strategic importance of water and power utilities as potential targets in modern cyber warfare. The exposure of these vulnerabilities has prompted calls for greater public-private collaboration and federal support. The risk is not limited to water utilities, as other sectors of critical infrastructure may face similar threats from state-sponsored actors. The revelations serve as a wake-up call for the urgent need to address cybersecurity gaps in essential services. The possibility of coordinated attacks on infrastructure during a geopolitical crisis could have far-reaching consequences for national security and public safety. The current state of preparedness among small utilities is insufficient to counter the scale and sophistication of the threat. The situation remains dynamic, with ongoing efforts to assess and mitigate the risks posed by foreign cyber actors.
Jul 12, 2026