A cyberattack does not have to contaminate drinking water or destroy equipment to disrupt a community or farm. Sometimes simply shutting down a pump, disabling an automated control or blocking access to operational information is enough to create an emergency.

Agricultural water facilities attacked in Israel

In July 2020, Ynet reported that cyber actors had attacked two small water and sewage installations serving agricultural areas in Israel. One incident involved pumps in the Upper Galilee, while the other affected infrastructure in the Mateh Yehuda area.

The Israeli Water Authority confirmed the incidents and said local operators repaired the systems immediately. Officials reported no interruption of service, infrastructure damage or other operational effects.

The limited consequences were largely the result of a quick local response—not an indication that agricultural water systems are unimportant targets.

Water System attacks reach at least seven U.S. states

Six years later, the risks are appearing across the United States. Reporting published in August 2026 indicated that cyberattacks had affected water-control systems in at least seven states and approximately 45 municipalities.

More than 30 community water systems in Minnesota were targeted during a coordinated wave of attacks. Michigan subsequently reported malicious activity affecting nine water systems. Most of the incidents involved operational technology used to monitor or control wells, pumps, treatment equipment, water towers and wastewater lift stations.

In Braham, Minnesota, attackers shut down the operating controls for the community’s well and water-treatment plant. The city temporarily relied on water already stored in its water tower while employees restored operations. Residents were briefly asked to conserve water, but officials reported no effect on water quality.

Other communities maintained service by switching from automated equipment to manual operating procedures. No evidence indicated that drinking water had been made unsafe.

Federal investigators have not publicly attributed these specific incidents. However, the attacks occurred after the EPA, FBI, CISA and NSA warned that Iran-affiliated cyber actors were targeting operational technology used by American water and wastewater systems. Iran is therefore suspected by some officials and cybersecurity experts, but that attribution has not been conclusively established publicly.

Why this matters to farms

Municipal utilities are not the only operations that depend on connected water controls. Farms increasingly use internet-connected technology to operate:

• Irrigation pumps and controllers.
• Livestock watering systems.
• Wells and water-storage equipment.
• Drainage and wastewater systems.
• Greenhouse watering and environmental controls.
• Sensors that monitor water pressure, flow and quality.
• Mobile applications that provide remote access to pumps and valves.

The attacks in Israel and the United States demonstrate that relatively small systems can become targets. Attackers may not care whether a controller belongs to a large city, a rural utility or an individual farm. They look for equipment that is exposed to the internet, uses default credentials, has outdated software or can be accessed through an unsecured remote connection.

Steps farms can take

Farm operators should identify every connected pump, irrigation controller, sensor and water-management device used by the operation. For each system:

• Change default usernames and passwords.
• Use strong, unique passwords and multi-factor authentication when available.
• Ask the vendor how remote access is secured.
• Install software and firmware updates promptly.
• Remove unnecessary connections to the public internet.
• Keep critical farm equipment separated from household and guest Wi-Fi.
• Back up controller settings and equipment configurations.
• Maintain written instructions for operating equipment manually.
• Develop an emergency plan for supplying water if automated systems fail.
• Keep vendor, technical-support and emergency contact information available offline.

The most important lesson is operational resilience. Technology can make water management more efficient, but every automated system needs a safe fallback. Farms should be prepared to continue watering livestock, irrigating crops and protecting water quality when computers or remote controls are unavailable.

Learn more from CyberPest Management Resources.

Sources

Raved, A. (2020, July 16). Israel’s water authorities came under cyber attack—officials say. Ynetnews.

Morales, J. (2026, August 2). Iran suspected of conducting cyberattacks on U.S. water suppliers in 45 municipalities—small towns mostly targeted, with utilities switching to manual control. Tom’s Hardware.

Casey, M. (2026, August 1). FBI investigates as Michigan joins Minnesota in reporting cyberattacks on its water systems. Associated Press.

U.S. Environmental Protection Agency. (2026, April 7). EPA, FBI, CISA, NSA issue joint cybersecurity advisory to water systems regarding Iranian-affiliated cyber attacks.