Chinese State-Linked Cyber Intrusions Targeting US Water Utilities
Hackers associated with China have gained unauthorized access to the IT networks of hundreds of small and medium-sized water utilities and other critical infrastructure providers across the United States. These intrusions are believed to be part of a broader strategy to position Chinese actors to sabotage American water and power supplies in the event of a geopolitical conflict, particularly if tensions escalate over Taiwan. U.S. officials have been aware of this threat for over two years, and recent reporting has brought renewed attention to the scale and persistence of these cyber operations. The targeted utilities are often located in rural areas and small towns, which typically lack the cybersecurity resources and expertise of larger metropolitan systems. The operational technology (OT) systems that control water treatment and distribution are especially vulnerable due to their increasing automation and remote accessibility. The risk is compounded by a significant resource gap, as many of these utilities struggle to defend against sophisticated nation-state threats. Efforts to bolster defenses have included the launch of two non-profit initiatives aimed at supporting critical infrastructure operators, but these programs face their own limitations. One of the non-profits has paused its activities to recalibrate its approach, while the other is only able to provide assistance in a limited number of states due to resource constraints. The threat underscores the broader challenge of protecting critical infrastructure in the United States, where many essential services are managed by small organizations with limited budgets. The potential for cyber sabotage of water and power systems raises concerns about the resilience of civilian infrastructure in the face of international conflict. U.S. government agencies have issued warnings and guidance to utilities, but implementation of robust security measures remains inconsistent. The situation highlights the need for increased investment in cybersecurity for critical infrastructure, particularly in rural and underserved areas. The ongoing threat from Chinese-linked hackers demonstrates the strategic importance of water and power utilities as potential targets in modern cyber warfare. The exposure of these vulnerabilities has prompted calls for greater public-private collaboration and federal support. The risk is not limited to water utilities, as other sectors of critical infrastructure may face similar threats from state-sponsored actors. The revelations serve as a wake-up call for the urgent need to address cybersecurity gaps in essential services. The possibility of coordinated attacks on infrastructure during a geopolitical crisis could have far-reaching consequences for national security and public safety. The current state of preparedness among small utilities is insufficient to counter the scale and sophistication of the threat. The situation remains dynamic, with ongoing efforts to assess and mitigate the risks posed by foreign cyber actors.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
1 event from the most recent confirmed update back to the earliest known activity.
Report highlights Chinese targeting of exposed US water utilities
BankInfoSecurity and GovInfoSecurity published a report describing U.S. water utilities as weak and exposed targets of Chinese hackers. No additional incident details, victim names, or dated developments are provided in the reference content.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hacktivist and Cyberattacks Targeting Water Utilities and Critical Infrastructure
Canada’s Centre for Cyber Security has issued a warning about the increasing threat posed by hacktivists and other malicious actors targeting industrial control systems (ICS) in critical sectors such as water, oil and gas, and agriculture. The agency highlighted recent real-world incidents where attackers gained access to control systems, including a case where hackers tampered with water pressure at a Canadian water utility, impacting customer service. The alert also referenced similar attacks in the United States, such as the Cyber Av3ngers’ intrusion into a Pennsylvania water authority’s ICS and the Oldsmar, Florida incident where a hacker attempted to alter chemical levels in the water supply. These events underscore the risks associated with internet-exposed ICS devices and the potential for operational disruption. In the United Kingdom, reports obtained from the Drinking Water Inspectorate (DWI) reveal that five cyberattacks have targeted Britain’s drinking water suppliers since early 2024. While none of these incidents directly compromised the safety of the water supply, they did affect the organizations responsible for its delivery. The DWI noted that current regulations only require formal reporting of cyber incidents that disrupt essential services, potentially leaving other significant threats unreported. British officials are considering changes to the legal framework to lower the threshold for mandatory disclosure of cyber incidents affecting critical infrastructure. Both Canadian and British authorities emphasize the growing cyber risk to water utilities and the need for improved resilience and reporting standards.
Mar 21, 2026
US Utilities Warn of Grid Cybersecurity Risks Amid Federal Funding Shortfalls
Utility executives and grid security analysts have warned Congress that U.S. federal funding for cybersecurity is not keeping pace with the increasing threat of nation-state cyber intrusions, particularly from Chinese actors. Leaders from investor-owned utilities, rural cooperatives, and national laboratories testified that Chinese hackers are already embedded within U.S. energy infrastructure, and that the next wave of attacks is likely to exploit persistent resource gaps, especially in rural systems and outdated operational technology. The testimony highlighted that modern cybersecurity defenses require significant upfront investment and ongoing funding, which many utilities—especially rural cooperatives—struggle to secure. The warnings come as researchers and officials describe a threat environment shaped by nation-state adversaries conducting pre-positioning campaigns, embedding themselves in operational technology networks in preparation for potential destructive attacks. Despite Congressional authorization for Department of Energy grants aimed at bolstering rural and municipal utility cybersecurity, the release of these funds has been delayed, further undermining the sector's readiness to defend against sophisticated cyber threats targeting critical infrastructure.
Mar 21, 2026
Poland Water Plant Breaches Spur Broader Critical Infrastructure Resilience Push
Poland’s Internal Security Agency said hackers breached five water treatment plants and could potentially have taken control of industrial equipment, raising the risk of compromised water safety and possible physical harm. The incidents were disclosed alongside a wider warning that sabotage campaigns targeting Polish military sites, civilian entities, and critical infrastructure pose an immediate threat, while Sweden separately reported that suspected pro-Russian hackers attempted to disrupt a thermal power plant but were stopped by built-in protections. Officials in both countries described the activity as part of a broader pattern of increasingly aggressive attacks on operational technology across Europe, particularly against infrastructure in countries supporting Ukraine. In the United States, the disclosures add urgency to CISA’s new **CI Fortify** initiative, which tells critical infrastructure operators in sectors including water, energy, transportation, and communications to prepare to keep essential services running for **weeks to months** while isolated from business networks, vendors, and telecom providers. CISA said the program is designed for scenarios in which attackers may already have access to OT environments and foreign adversaries are prepositioned inside U.S. infrastructure, with guidance focused on isolating control systems, maintaining offline and manual operations, and rehearsing recovery through tested backups, documentation, and component replacement plans.
May 14, 2026