jain.com — data centers, connectivity and security, analyzed daily

Tag: Oregon

  • 100+ Water System Hacks Show AI Cooling Risk Sits Outside the Data Center

    100+ Water System Hacks Show AI Cooling Risk Sits Outside the Data Center

    TL;DR · 30-second read

    The Short Version

    In July, hackers broke into the control systems of a drinking-water provider in Oregon. Officials have not said which one. It was part of a wave that reached at least 100 American water systems in seven states.

    The attackers reached small computers that run pumps and valves over the internet and locked operators out. Some towns saw water pressure drop, flooding, or a precautionary boil-water notice.

    This matters beyond your tap. Many of the huge computer buildings behind artificial intelligence use local tap water to stay cool, so a hacked water utility is their problem too.

    Oregon Public Broadcasting reported on August 7, 2026, that Oregon Gov. Tina Kotek’s office confirmed hackers gained access to an Oregon water district’s core operating technology in July. Oregon Enterprise Information Services, which provides cybersecurity support to state agencies, confirmed a July incident involving unauthorized access to operational technology used by an Oregon drinking-water provider. State officials would not name the district, would not say whether the incident is linked to a wider campaign, and said the impact is still being assessed.

    The Oregon disclosure follows a July 30 New York Times report that at least 100 US water systems had detected malicious attacks, which the paper said were initiated by hackers in Iran. An FBI release the same day acknowledged attacks in seven states and said some of the activity degraded water operations. At least 30 systems were targeted in Minnesota, where one treatment plant temporarily went offline; in Georgia, one system lost water pressure and briefly issued a boil-water precaution.

    Executive Summary

    An unnamed Oregon drinking-water provider is the latest confirmed victim of a July campaign against municipal water and sewage systems. According to the FBI, attackers connected over the internet to programmable logic controllers, the small industrial computers that run pumps and valves, then changed their IP addresses and passwords, cutting operators off from monitoring and control. Reported effects included loss of pressure and flooding.

    For the data center industry, the episode matters because water is an operating input, not only a sustainability metric. Facilities that reject heat through evaporative cooling draw continuously on local utilities. The campaign shows that at least 100 of those utilities could be reached directly from the internet within days. A data center’s resilience therefore depends partly on the security of infrastructure it neither owns nor audits.

    The same class of controller also runs chilled-water plants, pumps and valves inside data centers. The FBI’s guidance to water utilities, to limit remote access and keep manual fallback procedures, reads as a checklist for cooling plant operators as well.

    What the FBI Says Happened

    The FBI’s description of the attack is short and specific. Between July 27 and July 30, attackers connected to programmable logic controllers (PLCs), rugged single-purpose computers that open valves, start pumps and read sensors, directly over the internet. They then changed the devices’ IP addresses and passwords, which the agency said resulted in a loss of monitoring and control. Operators could no longer see or steer parts of their own systems.

    The consequences were physical. The FBI said operational effects included loss of pressure and flooding, and warned that pressure loss could potentially allow untreated groundwater to seep into pipes. In Minnesota, where at least 30 systems were targeted, one treatment plant temporarily went offline. In Georgia, a pressure drop prompted a precautionary boil-water notice.

    Attribution remains partly open. The New York Times reported the campaign was initiated by hackers in Iran. Oregon officials declined to say whether their incident belongs to that campaign and referred questions to federal investigators. That caution is reasonable while the investigation continues, and the operational lessons do not depend on who was behind the attacks.

    Why AI Cooling Risk Sits Outside the Fence

    Many data centers remove heat with evaporative cooling towers, which lose water continuously to evaporation and replace it, as so-called makeup water, from the local municipal supply. AI clusters pack far more heat into each rack than conventional servers. Even when the chips are cooled directly by liquid, that heat still has to leave the building, and in many designs it leaves through those same towers. For a significant share of facilities, water pressure at the meter is as much a dependency as power at the substation.

    The failure modes the FBI listed match that dependency closely. A pressure loss or an offline treatment plant is exactly the event a cooling plant’s onsite water storage exists to ride through. What the July campaign changes is the likelihood and breadth of that event. At least 100 systems in at least seven states were affected in a matter of days. The technique did not require first breaching a corporate network, because the controllers were reachable from the internet. A risk that site selection teams once modelled as drought or main breaks now has a cyber path, and it can hit many utilities simultaneously.

    The people exposed are the ones who build, lease and finance capacity: operators sizing onsite storage, tenants whose service agreements assume cooling continuity, and lenders underwriting sites in water-dependent markets. Oregon hosts major data center clusters around Hillsboro, The Dalles and Prineville. Nothing disclosed so far indicates the affected district serves any of them. The point is structural, not local.

    The Same Controllers Run the Chiller Plant

    PLCs are not unique to water utilities. The same kind of device, often from the same vendors, sequences chillers, modulates pumps and controls valves in data center mechanical plants. Remote access is common there for the same reason Tualatin Valley Water District spokesperson Justin Dyke gave for utilities: it lets operators respond quickly when demand shifts. The convenience cuts both ways when a controller’s management interface is reachable from the open internet.

    The FBI’s recommendations to water systems translate almost directly. Limit remote access to controllers. Enforce authentication and other security protocols. Maintain manual procedures for when automation is lost. Dyke described that last practice at his district: if online systems go down, operators make changes by hand. Data center operators can apply the same test to their cooling plants and ask whether staff can run the chilled-water system safely with the controls network unavailable.

    A Defense Spread Across 2,500 Districts

    Oregon has more than 2,500 water districts, and all of its drinking-water systems are locally managed. Oregon Enterprise Information Services consults with districts on cybersecurity and threat assessments but does not run them. That structure is typical of US water and puts security decisions in the hands of many small operators with limited budgets and staff.

    It also limits disclosure. The Portland Water Bureau said it routinely examines vulnerabilities with the city’s security team, the Cybersecurity and Infrastructure Security Agency and the FBI, but declined to say whether it was targeted in July. Tualatin Valley reported an increase in attempts, none successful. Klamath Falls and Corvallis reported no increase, and Redmond and Bend reported no breach. For a large water customer, that patchwork means a utility’s security posture is mostly invisible unless the customer asks directly.

    Background

    Water utilities have spent years connecting their treatment plants, pumping stations and reservoirs to remote monitoring. This lets small operating teams adjust flow and reservoir levels quickly as demand changes. The same connectivity, when controllers are reachable from the internet, exposes physical equipment to remote tampering. Federal agencies, including the FBI and the Cybersecurity and Infrastructure Security Agency, work with utilities on these risks, but in states like Oregon, day-to-day operation and security remain local responsibilities.

    Oregon is also one of the country’s established data center markets, with large campuses around Hillsboro, The Dalles and Prineville. Water supply has featured in local debate about their growth. As AI workloads raise heat density per rack, cooling design, and for many facilities the municipal water behind it, has become a primary constraint on where and how capacity gets built.

    Sources

    Source: Oregon drinking water system accessed in recent cyber attacks (Oregon Public Broadcasting): Oregon officials confirm a July intrusion into a water provider’s operating technology amid a national campaign against water utilities.

  • Hillsboro’s 120-Day Pause Spares 7 Data Center Sites; AI Builders Face the Rewrite

    Hillsboro’s 120-Day Pause Spares 7 Data Center Sites; AI Builders Face the Rewrite

    TL;DR · 30-second read

    The Short Version

    Hillsboro, Oregon, a Portland suburb, already has 35 data centers. These are giant warehouse-style buildings full of computers that run the internet and artificial intelligence. The city has now voted to stop accepting new proposals for them for 120 days.

    Nothing already running, being built or under review is affected. What changes is the rulebook for whatever comes next.

    The pause also covers big battery sites that store electricity for later. The local power company asked the city to leave those out.

    Oregon Public Broadcasting reported that the Hillsboro City Council unanimously adopted a 120-day moratorium on new land-use applications for data centers and battery energy storage system (BESS) sites at a special meeting on Monday, July 27, 2026. It is the first such moratorium in Oregon. Hillsboro has 35 data centers, according to the website Data Center Maps, which is more than any other city in the state. The city says at least seven more sites are under construction or moving through permitting.

    The pause does not affect existing data centers or projects whose land-use applications were already submitted. The council may extend it once for another 120 days. The city gave one day’s notice of the meeting, which Mayor Beach Pace said was meant to keep companies from rushing applications in before the cutoff.

    Executive Summary

    Hillsboro, the center of the cluster of technology firms around Portland known as Oregon’s Silicon Forest, has temporarily stopped accepting new land-use applications for data centers and grid-scale battery sites. The city says it will use the pause to study the facilities’ impacts and amend its community development code to regulate them.

    The headline word is moratorium, but the practical effect is narrower. Operating campuses and already-filed projects continue, so Hillsboro’s near-term data center pipeline keeps moving. The lasting change will be the zoning rules that emerge from the study. Those rules will govern every new campus proposed in one of the Pacific Northwest’s most established data center markets, at a time when AI computing demand is driving much of the industry’s new capacity.

    The vote also adds to a broader tightening in Oregon. The state has paused new data center tax breaks, approved higher power rates for large users, and set up a governor’s advisory council on data centers.

    What the Pause Actually Freezes

    The moratorium is narrower than the word suggests. It stops Hillsboro from accepting new land-use applications, which are the zoning filings a developer needs before a project can move through local approvals. It does not touch the city’s roughly 35 operating data centers, and it exempts any project whose application was already on file. By the city’s own count, at least seven more sites were under construction or moving through permitting at the time of the vote. Projects at those stages have, in the ordinary course, already passed the point the moratorium blocks.

    Mayor Beach Pace’s reason for calling the meeting on a day’s notice points the same way. The concern was that companies would rush applications in before the cutoff. That suggests the city expected a queue of projects ready to file, and that the pause is aimed at the next round rather than at capacity already committed.

    In the near term, then, Hillsboro’s data center footprint keeps growing. The moratorium does not change the buildings going up now. It changes the terms for whatever comes after them.

    The Code Rewrite Is What AI Builders Should Watch

    The city’s stated goal is to study the impacts of data centers and battery sites and amend its community development code to regulate them. That is the outcome that will last. The moratorium itself expires after 120 days, or 240 if the council uses its single extension. City Attorney Chad Jacobs told the council that state law limits moratoriums to 120 days, and the ordinance allows one renewal. Zoning amendments, by contrast, stay on the books and govern every future application.

    For developers, that moves the main risk from delay to design. A four-to-eight-month pause is an inconvenience on a multi-year data center schedule. New siting standards, depending on what they cover, could change which parcels are viable and what a campus must include to be approved. Across the industry, much of the next wave of capacity is being driven by AI computing demand. That typically means larger, more power-dense campuses, which are the projects most exposed to new local rules on land, power and water.

    The council has not said what the amendments will contain, and the testimony pulled in different directions. That uncertainty, more than the 120 days, is what a company weighing a new Hillsboro site has to factor in.

    Batteries Caught in the Same Net

    The most contested decision was to include battery energy storage systems. These are large banks of batteries that absorb electricity when it is plentiful and release it when demand peaks. Portland General Electric and clean-energy advocates asked the council to exclude them. Adam Capage of Renewable Northwest said the facilities “play a vital role in Oregon’s energy future” and already support resilience and affordable electric service in Hillsboro.

    Councilors Cristian Salgado and Rob Harris acknowledged that battery sites and data centers are different, though they often come together. They argued the city needs to understand both before writing rules. That is a reasonable argument about order of operations, but it has a cost. Storage is one of the tools utilities use to manage demand peaks as large new loads connect. Pausing new battery applications at the same time as the loads leaves an open question for grid planning in the area during the study period.

    A Market Tightening From Several Directions

    Hillsboro’s vote follows several state-level changes. Earlier this year the Oregon Legislature enacted a one-year pause on new data center tax breaks through the Enterprise Zone program. In July the Public Utility Commission approved Portland General Electric’s 29.7% rate increase for large energy users, while residential rates fell 1.3%. Governor Tina Kotek has said the state is a “cheap date” for data centers and suggested more changes are coming.

    Each measure targets a different cost: taxes, power prices and now land use. Together they show that Oregon is renegotiating its terms for large facilities. The Washington County Chamber of Commerce, the Westside Economic Alliance and three building-trades unions argued for letting established planning processes and the governor’s data center advisory council finish first. Most residents who testified supported the pause. Both positions have merit. The chamber’s point about sequencing is reasonable, and so is the city’s view that it cannot write sound rules for facilities whose local impacts it has not studied.

    Background

    Hillsboro, in Washington County west of Portland, is the center of Oregon’s Silicon Forest. The area has long been home to semiconductor manufacturing and has become the state’s densest cluster of data centers. Many large operators have received long-running property tax breaks through Oregon’s Enterprise Zone program. Those breaks became a local flashpoint this spring as residents learned how long they would last.

    State policy has been shifting as well. The Legislature paused new Enterprise Zone tax breaks for data centers for one year. Regulators approved higher electricity rates for large power users such as data centers under a new state law. Governor Tina Kotek has said Oregon is a “cheap date” for the industry and suggested more changes are coming, and her data center advisory council is still working on recommendations.

    Sources

    Source: Hillsboro approves data center moratorium, Oregon Public Broadcasting’s report on the Hillsboro City Council’s July 27, 2026 vote.

  • Oregon Approves PGE’s 29.7% Data Center Rate Hike Under Landmark POWER Act

    Oregon Approves PGE’s 29.7% Data Center Rate Hike Under Landmark POWER Act

    Oregon regulators have approved a 29.7% electricity rate increase for data centers served by Portland General Electric (PGE), the state’s largest utility, as reported by Oregon Public Broadcasting on July 6, 2026. The decision is the first major rate action taken under Oregon’s landmark POWER Act, a 2025 law that directed regulators to place large energy users such as data centers into their own rate class so that the costs of serving them are not spread across households and small businesses.

    Executive Summary

    The approval makes Oregon one of the first states to move from debating data-center cost allocation to actually pricing it. Under the POWER Act — passed in 2025 amid rapid data-center load growth and rising residential bills — utilities must charge very large customers rates that reflect the full cost of serving them, including the new generation and transmission their demand triggers. The 29.7% figure now approved for PGE’s data-center class is the concrete output of that mandate.

    Why it matters: electricity has become the gating resource for AI and cloud expansion, and the question of who funds grid upgrades — the data centers driving demand, or all ratepayers — is now the central fight in utility regulation. Oregon has produced a working template, with a specific number attached, that commissions and legislatures in Virginia, Georgia, Ohio, Texas and elsewhere are likely to study closely.

    Who Pays for the AI Buildout Just Got a Concrete Answer

    For most of the past century, utilities spread the cost of new infrastructure across all customers on the theory that everyone benefits from a stronger grid. Data centers broke that logic: a single hyperscale campus can demand as much power as a small city, arriving faster than utilities can build generation and wires. When those costs land in general rates, households effectively subsidize some of the world’s largest companies. Oregon’s POWER Act rejected that outcome by mandating a separate rate class — a distinct pricing category with its own cost-based rates — for large energy users.

    The 29.7% increase is the first hard number to emerge from that framework. It represents a regulator’s judgment, tested through a formal rate proceeding, of what cost-causation pricing for data centers actually looks like at PGE. Whether one views the number as fair depends on the underlying cost studies, which the reporting summarized here does not detail — but the structural shift is unambiguous: growth-driven costs are being assigned to the customers driving the growth.

    A Template Other States Will Study — and Contest

    Regulators across the country are wrestling with the same problem, mostly through case-by-case special contracts with individual data-center customers. Oregon instead wrote the principle into statute and applied it class-wide, which offers predictability but less flexibility. Expect both sides of the national debate to cite this decision: consumer advocates as proof that ratepayer protection is achievable, and data-center developers as evidence of rising regulatory risk in some markets.

    The competitive question is real. Oregon, particularly the Portland-Hillsboro area that PGE serves, built a significant data-center cluster on the strength of relatively inexpensive Northwest power and long-standing tax incentives. A nearly 30% jump in the power line-item — often the largest operating cost of a modern facility — changes site-selection math. States hungry for data-center investment may market themselves against Oregon’s approach; states worried about residential bills may copy it. Either way, the era of uniform, geography-blind data-center power pricing is ending.

    The Economics Cut Both Ways

    For utilities, a dedicated large-load class is double-edged. It insulates existing customers and reduces political backlash against growth, but it also raises the price of the very load that funds new investment. If data-center operators respond by self-supplying — building on-site generation, contracting directly with power producers, or siting behind other utilities — PGE could face slower load growth than planned, and the fixed costs of any already-committed infrastructure would need a home.

    For operators, the decision reinforces a trend already visible across the industry: power strategy is now a first-order business function, not a facilities detail. Companies that locked in long-term supply arrangements, invested in efficiency, or diversified their geographic footprint are better positioned than those that assumed grid power would stay cheap and socialized. The Oregon decision does not end data-center growth in the state — but it prices that growth honestly, and honest prices change behavior.

    Background

    Oregon became a data-center destination over the past two decades thanks to relatively inexpensive Pacific Northwest power, a mild climate, strong fiber routes, and generous local tax incentives — attracting major cloud and internet companies to clusters around Hillsboro in PGE territory and along the Columbia River. As AI workloads accelerated demand in the 2020s, utilities projected unprecedented load growth while residential electric bills climbed, fueling a political backlash over who should fund grid expansion.

    The POWER Act, passed in 2025, was Oregon’s answer: separate very large energy users into their own rate class and charge them the full cost of serving them. The rate decision reported here is the first major application of that law, moving the cost-allocation debate from principle to an approved price.

    Source: Oregon approves PGE’s 29.7% rate hike for data centers under landmark law — Oregon Public Broadcasting report on the first major rate decision under Oregon’s POWER Act, published July 6, 2026.