Steve Bucci warns of growing cyber threat to US water infrastructure
Former top Pentagon official and Heritage Foundation visiting fellow Steve Bucci joins ‘Fox & Friends First’ to analyze the surge of cyberattacks on U.S. water infrastructure. Bucci warns that state-sponsored actors, including Iran-backed hackers, are exploiting vulnerable digital systems in municipal utilities. He emphasizes the urgent need for local governments to isolate critical controls from the public internet.
NEWYou can now listen to Fox News articles!
Foreign actors hacked two Colorado water utilities’ computer systems last month, changing pumping cycles, disabling alarms and altering equipment settings before operators regained control, state officials said Thursday.
The intrusions did not affect drinking water quality or treatment processes, according to Colorado Gov. Jared Polis’ office. But the incidents add Colorado to a widening series of breaches on U.S. water and wastewater infrastructure.
High-profile cyberattacks have targeted more than 100 drinking water and wastewater systems across 12 states this year, according to the Environmental Protection Agency, expanding the footprint of a threat that federal authorities warned this summer was disrupting water operations across the country.
WATER CYBERATTACK HITS AT LEAST 7 STATES
Hackers targeted computerized controls at more than 30 Minnesota water systems, forcing some utilities to use manual operations and backup procedures. (Tony Webster/Wikimedia Commons)
Colorado officials have not identified the actors behind the intrusions of the two small systems or said whether they are connected to the broader activity reported elsewhere in the country.
“These were brief incidents, and the risks were quickly addressed by the providers themselves, who subsequently alerted the state,” Polis spokeswoman Eric Maruyama said in a statement.
The hackers altered equipment settings, disabled remote access and alarms and changed pumping cycles, according to the governor’s office.
The incidents demonstrate how hackers can reach beyond traditional computer networks and gain access to operational technology used to control physical equipment at water facilities, including pumps, valves and other machinery.
The water utility systems that were impacted provide drinking water to approximately 400 people.
IRANIAN HACKERS ATTACKED OUR WATER SYSTEMS. HERE ARE 5 THINGS OUR LEADERS NEED TO DO NOW
Federal authorities warned in July that malicious cyber actors were targeting internet-connected operational technology at water and wastewater utilities. At the time, the FBI and EPA said utilities in at least seven states had reported incidents, some of which degraded water operations.
The agencies said attackers had remotely accessed internet-facing programmable logic controllers, or PLCs, and tampered with device configurations, in some cases causing utilities to lose monitoring or control capabilities. Reported operational effects included loss of water pressure and flooding.
The Colorado breaches follow a series of attacks on water systems across the country this summer, including cyber activity affecting more than 30 community water systems in Minnesota.
Colorado Gov. Jared Polis speaks to the National Governors Association at the Broadmoor Hotel in Colorado Springs, Colo., July 25, 2025. (AP)
Federal investigators have examined whether Iranian actors or hackers affiliated with Iran were responsible for the Minnesota attacks, though officials had not publicly attributed the activity at the time.
President Donald Trump disputed suggestions that Iran was behind the Minnesota attacks, saying during a Cabinet meeting, “They blame it on Iran. I don’t think so,” and instead blamed Minnesota officials.
IRAN’S CYBERWAR TARGETS ORDINARY AMERICANS. WE NEED TO DISMANTLE THE HACKER NETWORK
The recent incidents have renewed attention on longstanding cybersecurity vulnerabilities within America’s water infrastructure, particularly among small and rural utilities that can have limited cybersecurity staff and resources.
Many utilities use internet-connected industrial control systems to remotely monitor and operate pumps, valves, water pressure and other equipment. Federal officials have urged operators to remove programmable logic controllers from direct exposure to the internet and strengthen authentication and access controls.
The EPA, which serves as the federal government’s sector risk management agency for water and wastewater systems, told Fox News Digital it is working with utilities, states and federal partners to identify vulnerabilities and strengthen cybersecurity.
Environmental Protection Agency Headquarters Building in Washington DC (Getty)
Since fiscal year 2025, the agency has identified more than 900 vulnerabilities at over 650 water systems and helped eliminate about 700 at more than 500 utilities.
EPA has also conducted more than 710 cybersecurity risk assessments and provided direct technical assistance to approximately 15,900 utilities.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
The FBI declined to comment when reached by Fox News Digital.