Tag: Water Utility Cybersecurity

  • AI Data Center Water Risk Runs Through 50,000 Utilities’ Cyber Defenses

    AI Data Center Water Risk Runs Through 50,000 Utilities’ Cyber Defenses

    TL;DR · 30-second read

    The Short Version

    A cybersecurity company called Cyware is teaming up with WaterISAC, the group that helps American water utilities warn each other about hackers.

    The goal is simple: when one water system spots an attack, the warning should reach the others fast, including thousands of tiny rural systems with little or no security staff.

    Why it matters beyond your tap: many of the huge computer buildings that power artificial intelligence rely on the local water supply to stay cool and to fight fires. If the local water plant is hacked, those buildings are exposed too. No price or timeline was announced.

    Cyware announced on Sept. 30, 2026, in a release distributed via PR Newswire, a partnership with WaterISAC, the information-sharing organization for the US water sector. Under the arrangement, WaterISAC will use Cyware’s threat intelligence platform to collect, enrich and distribute cyber threat data and vulnerability alerts to water and wastewater utilities.

    WaterISAC said its existing partnership with the National Rural Water Association already lets it serve more than 20,000 of the sector’s smallest utilities, and that Cyware was selected after an evaluation of available platforms. No financial terms, contract length or rollout schedule were disclosed.

    Executive Summary

    WaterISAC, the hub through which US water utilities, security experts and government partners share threat warnings, is moving its intelligence work onto Cyware’s platform. The stated aim is to replace manual processes for gathering and enriching threat data with automation, so that alerts reach members faster and larger utilities can receive intelligence directly.

    The deal matters because the US water sector is extraordinarily fragmented. The release counts more than 50,000 utilities, many of them small, and argues that each one is a potential point of failure. Collective defense, the idea that a threat seen by one member protects all of them, only works if warnings reach the weakest participants in a form they can act on.

    For data center operators, the announcement is a reminder that a facility’s physical resilience depends on infrastructure it does not control. Cooling systems that draw on municipal water, and fire-suppression systems fed by the local supply, inherit the cyber posture of whichever utility serves the site.

    Why a Water-Sector Deal Belongs on a Data Center Risk Register

    Data center resilience planning usually focuses on what sits inside the fence: backup generators, redundant cooling loops, dual fiber paths. Water is often treated as a commodity input. But many facilities, especially those using evaporative or other water-based cooling, draw on the local municipal supply, and building fire-suppression systems commonly depend on it as well. The Cyware release itself lists fire suppression alongside drinking water and sanitation as a core function of water systems.

    That dependency runs through operational technology, or OT: the control systems that run pumps, valves, chemical dosing and treatment at a water plant. Cyware’s release states that adversaries targeting OT now move at machine speed. If a utility’s controls are disrupted, pressure and supply can be affected for every customer on that system, including a data center campus. The operational conclusion is that the relevant cyber defender for a site’s water is not a national agency or a large vendor, but one of more than 50,000 local utilities, each with its own level of security staffing and maturity.

    For operators and developers, that makes the local utility’s cyber posture a legitimate site-selection and resilience input, weighed alongside on-site water storage and cooling design. It also means that sector-wide efforts like WaterISAC’s affect data center risk indirectly: a better-informed local utility is a more dependable upstream supplier.

    The Small-Utility Problem Is the Real Test

    The most revealing detail in the announcement is structural. WaterISAC says its partnership with the National Rural Water Association already lets it serve more than 20,000 of the smallest utilities. WaterISAC Executive Director Tom Dobbins described the Cyware platform as helping WaterISAC’s analysts deliver more real-time insights to members and letting the organization extend intelligence directly to larger utilities.

    Read together, those statements suggest a tiered model: analysts work in the platform, larger utilities may connect directly, and smaller utilities receive curated output. That is a reasonable design, since a rural system with no dedicated security staff cannot ingest a raw threat feed. But it also means the speed gains Cyware describes will be felt most by larger members and by WaterISAC’s own analysts. Whether a warning reaches every participant regardless of size, as Cyware’s Tom Stockmeyer framed the goal, depends on how that last step is handled.

    What the AI Claims Establish, and What They Do Not

    Cyware positions itself around agentic AI, meaning software that automates steps an analyst would otherwise perform, such as collecting, enriching and routing threat data. The release says this will help WaterISAC significantly reduce manual effort and deliver intelligence more efficiently. Those are plausible benefits for an intelligence team, but the release offers no baseline, no target metrics and no description of how automated outputs are validated before distribution.

    It is also worth separating intelligence speed from response speed. A warning delivered in seconds helps only if the recipient can act on it. For a small utility, the bottleneck is often people and budget rather than information. The partnership addresses the information side; the response side remains with each utility. Cyware has also said it is supporting NRECA on Department of Energy-funded research into automated collective defense for electric cooperatives, which places the company across both utility inputs that data centers depend on most: power and water.

    Background

    The US water sector is unusually fragmented: more than 50,000 utilities, ranging from large metropolitan systems to small rural operations with minimal staff. WaterISAC serves as the sector’s information-sharing hub, one of a family of industry-specific ISACs that pool threat warnings so members can learn from one another. Through its partnership with the National Rural Water Association, WaterISAC says it reaches more than 20,000 of the smallest utilities.

    Cyware is a threat intelligence software vendor that unifies intelligence management, sharing and collaboration, and orchestration and automation. It markets itself around agentic AI and collective defense, and counts enterprises, government agencies and ISACs among its customers. The WaterISAC deal extends that ISAC-focused strategy into a sector whose resilience underpins other infrastructure, including data centers that rely on local water for cooling and fire protection.

    Sources

    Source: Cyware and WaterISAC Join Forces to Strengthen Water Sector Cyber Defense, Cyware’s Sept. 30, 2026 announcement of its threat intelligence partnership with WaterISAC.

  • 100+ Water System Hacks Show AI Cooling Risk Sits Outside the Data Center

    100+ Water System Hacks Show AI Cooling Risk Sits Outside the Data Center

    TL;DR · 30-second read

    The Short Version

    In July, hackers broke into the control systems of a drinking-water provider in Oregon. Officials have not said which one. It was part of a wave that reached at least 100 American water systems in seven states.

    The attackers reached small computers that run pumps and valves over the internet and locked operators out. Some towns saw water pressure drop, flooding, or a precautionary boil-water notice.

    This matters beyond your tap. Many of the huge computer buildings behind artificial intelligence use local tap water to stay cool, so a hacked water utility is their problem too.

    Oregon Public Broadcasting reported on August 7, 2026, that Oregon Gov. Tina Kotek’s office confirmed hackers gained access to an Oregon water district’s core operating technology in July. Oregon Enterprise Information Services, which provides cybersecurity support to state agencies, confirmed a July incident involving unauthorized access to operational technology used by an Oregon drinking-water provider. State officials would not name the district, would not say whether the incident is linked to a wider campaign, and said the impact is still being assessed.

    The Oregon disclosure follows a July 30 New York Times report that at least 100 US water systems had detected malicious attacks, which the paper said were initiated by hackers in Iran. An FBI release the same day acknowledged attacks in seven states and said some of the activity degraded water operations. At least 30 systems were targeted in Minnesota, where one treatment plant temporarily went offline; in Georgia, one system lost water pressure and briefly issued a boil-water precaution.

    Executive Summary

    An unnamed Oregon drinking-water provider is the latest confirmed victim of a July campaign against municipal water and sewage systems. According to the FBI, attackers connected over the internet to programmable logic controllers, the small industrial computers that run pumps and valves, then changed their IP addresses and passwords, cutting operators off from monitoring and control. Reported effects included loss of pressure and flooding.

    For the data center industry, the episode matters because water is an operating input, not only a sustainability metric. Facilities that reject heat through evaporative cooling draw continuously on local utilities. The campaign shows that at least 100 of those utilities could be reached directly from the internet within days. A data center’s resilience therefore depends partly on the security of infrastructure it neither owns nor audits.

    The same class of controller also runs chilled-water plants, pumps and valves inside data centers. The FBI’s guidance to water utilities, to limit remote access and keep manual fallback procedures, reads as a checklist for cooling plant operators as well.

    What the FBI Says Happened

    The FBI’s description of the attack is short and specific. Between July 27 and July 30, attackers connected to programmable logic controllers (PLCs), rugged single-purpose computers that open valves, start pumps and read sensors, directly over the internet. They then changed the devices’ IP addresses and passwords, which the agency said resulted in a loss of monitoring and control. Operators could no longer see or steer parts of their own systems.

    The consequences were physical. The FBI said operational effects included loss of pressure and flooding, and warned that pressure loss could potentially allow untreated groundwater to seep into pipes. In Minnesota, where at least 30 systems were targeted, one treatment plant temporarily went offline. In Georgia, a pressure drop prompted a precautionary boil-water notice.

    Attribution remains partly open. The New York Times reported the campaign was initiated by hackers in Iran. Oregon officials declined to say whether their incident belongs to that campaign and referred questions to federal investigators. That caution is reasonable while the investigation continues, and the operational lessons do not depend on who was behind the attacks.

    Why AI Cooling Risk Sits Outside the Fence

    Many data centers remove heat with evaporative cooling towers, which lose water continuously to evaporation and replace it, as so-called makeup water, from the local municipal supply. AI clusters pack far more heat into each rack than conventional servers. Even when the chips are cooled directly by liquid, that heat still has to leave the building, and in many designs it leaves through those same towers. For a significant share of facilities, water pressure at the meter is as much a dependency as power at the substation.

    The failure modes the FBI listed match that dependency closely. A pressure loss or an offline treatment plant is exactly the event a cooling plant’s onsite water storage exists to ride through. What the July campaign changes is the likelihood and breadth of that event. At least 100 systems in at least seven states were affected in a matter of days. The technique did not require first breaching a corporate network, because the controllers were reachable from the internet. A risk that site selection teams once modelled as drought or main breaks now has a cyber path, and it can hit many utilities simultaneously.

    The people exposed are the ones who build, lease and finance capacity: operators sizing onsite storage, tenants whose service agreements assume cooling continuity, and lenders underwriting sites in water-dependent markets. Oregon hosts major data center clusters around Hillsboro, The Dalles and Prineville. Nothing disclosed so far indicates the affected district serves any of them. The point is structural, not local.

    The Same Controllers Run the Chiller Plant

    PLCs are not unique to water utilities. The same kind of device, often from the same vendors, sequences chillers, modulates pumps and controls valves in data center mechanical plants. Remote access is common there for the same reason Tualatin Valley Water District spokesperson Justin Dyke gave for utilities: it lets operators respond quickly when demand shifts. The convenience cuts both ways when a controller’s management interface is reachable from the open internet.

    The FBI’s recommendations to water systems translate almost directly. Limit remote access to controllers. Enforce authentication and other security protocols. Maintain manual procedures for when automation is lost. Dyke described that last practice at his district: if online systems go down, operators make changes by hand. Data center operators can apply the same test to their cooling plants and ask whether staff can run the chilled-water system safely with the controls network unavailable.

    A Defense Spread Across 2,500 Districts

    Oregon has more than 2,500 water districts, and all of its drinking-water systems are locally managed. Oregon Enterprise Information Services consults with districts on cybersecurity and threat assessments but does not run them. That structure is typical of US water and puts security decisions in the hands of many small operators with limited budgets and staff.

    It also limits disclosure. The Portland Water Bureau said it routinely examines vulnerabilities with the city’s security team, the Cybersecurity and Infrastructure Security Agency and the FBI, but declined to say whether it was targeted in July. Tualatin Valley reported an increase in attempts, none successful. Klamath Falls and Corvallis reported no increase, and Redmond and Bend reported no breach. For a large water customer, that patchwork means a utility’s security posture is mostly invisible unless the customer asks directly.

    Background

    Water utilities have spent years connecting their treatment plants, pumping stations and reservoirs to remote monitoring. This lets small operating teams adjust flow and reservoir levels quickly as demand changes. The same connectivity, when controllers are reachable from the internet, exposes physical equipment to remote tampering. Federal agencies, including the FBI and the Cybersecurity and Infrastructure Security Agency, work with utilities on these risks, but in states like Oregon, day-to-day operation and security remain local responsibilities.

    Oregon is also one of the country’s established data center markets, with large campuses around Hillsboro, The Dalles and Prineville. Water supply has featured in local debate about their growth. As AI workloads raise heat density per rack, cooling design, and for many facilities the municipal water behind it, has become a primary constraint on where and how capacity gets built.

    Sources

    Source: Oregon drinking water system accessed in recent cyber attacks (Oregon Public Broadcasting): Oregon officials confirm a July intrusion into a water provider’s operating technology amid a national campaign against water utilities.