Water and Waste Water

August 25, 2026

Two small water utility systems in Colorado suffered a cyberattack late last month and it appears foreign threat actors conducted the hack, state officials said.
This attack occurred after hackers hit water facilities in other states like in Minnesota where over 30 small water systems ended up hit. Federal officials associated those attacks with threat actors affiliated with Iran.
It remains uncertain as to who the threat actors were or if the attempted interference was related to the July hacking attempts that affected 12 states

June 11, 2026

Iran-linked attack group, Handala, said it compromised California Water Service (Cal Water) in retaliation for recent U.S. actions in Iran.
In an effort to show proof, the attack group published 5GB proof-of-concept data that appears to contain customer billing personally identifiable information (PII) and administrative credentials for an internal RTKBase NTRIP GPS correction network covering seven Cal Water service districts.
In a post on their blog, the hacking group said the intrusion was in retaliation for recent U.S. actions in Iran and claimed they had the ability to disrupt water access but chose not to.
On Thursday, June 11, threat intelligence provider, Dataminr issued a Flash alert detecting a Handala claim of compromise against Cal Water. The organization is one of the largest investor-owned water utilities in the United States, serving two million customers across 100 California communities.

August 9, 2025

Milwaukee, Wisconsin-based EMC Water LLC fell victim to an attack emanating from a vulnerability in the Oracle’s E-Business Suite (“EBS”) software where the threat actor made off with files containing personally identifiable information.
EMC Water, like multiple other organizations use Oracle’s E-Business Suite software to help manage their operations. An unauthorized actor leveraged a previously unknown vulnerability in Oracle EBS to take information from numerous organizations’ Oracle EBS applications.
That is what happened in late November when EMC Water discovered it was one of those organizations.

March 4, 2025

Clearwater, Florida-based Dosatron International, LLC, a water-powered dosing pump manufacturer, suffered a cyberattack back in March and is now informing victims of the hack their personally identifiable information ended up stolen.
On March 4, attackers were able to hack into a Dosatron web site and pull customer data off the network.
“We recently learned that an unauthorized party temporarily gained access to the payment portal of one of our websites, https://dilutionsolutions.com,” the company said in a letter to victims of the attack. “Payment card data entered by our customers during this period, including your card data, may have been intercepted by the unauthorized party. On May 28, 2025, we became aware of this unauthorized access to the website and promptly took action to stop it. We also began an investigation of the incident.”

July 31, 2024

An investigation and victim research is finally over and the Rancho Cucamonga, CA-based Cucamonga Valley Water District (CVWD) is informing victims of a ransomware attack the organizations suffered last July.
The Cucamonga Valley Water District discovered the attack on August 15, 2024, that started on July 31. The attack impacted their phone systems and online payment processing. While water service did not end up affected because it operates on a separate network, the attack disrupted their ability to process payments made over the phone, according to the district.
“Upon discovery of ransomware, CVWD immediately engaged third-party specialists and notified federal law enforcement,” the company said in a December update. “CVWD had in place robust software and systems that were able to immediately identify the intrusion and allowed us to react quickly to restore phone and payment systems within days. Within weeks, all systems were fully restored. CVWD did not pay a ransom.”

October 6, 2025

Virginia Beach, Virginia-based regional wastewater treatment facility Hampton Roads Sanitation District (HRSD) discovered a cyberattack at its facility in October
“On October 6, 2025, HRSD was made aware of unusual activity in its network,” the organization said in a letter to victims. “Upon discovery of the incident, HRSD promptly implemented its incident response plan and began an investigation into the nature and scope of the issue.”
The company’s preliminary investigation found evidence a threat actor accessed HRSD’s network and stole certain files.