Daily Survival: Hackers Are Targeting America’s Water Supply: Here’s What Every Household Should Have Ready

Tuesday, October 27, 2026

Hackers Are Targeting America’s Water Supply: Here’s What Every Household Should Have Ready

Most people picture a water outage as a broken main, a drought, or a hurricane knocking out the treatment plant. Now there’s another threat on the list, and it doesn’t need bad weather. Hackers are breaking into the computers that control America’s drinking water.

On October 1, the National Institute of Standards and Technology published an analysis of the recent attacks on water and wastewater systems, warning that they highlight an escalating threat to critical infrastructure. The attackers didn’t go after billing systems or email. They went after the equipment that physically treats and moves your water.

What Actually Happened

In late July, water utilities across the country reported a sharp jump in cyberattacks. In Minnesota alone, a coordinated attack hit control systems at more than 30 community water systems over a single weekend. The FBI received reports from utilities in at least seven states.

The targets were programmable logic controllers, or PLCs. These are small industrial computers that run pumps, valves, and chemical dosing at treatment plants and remote stations. Many were reachable directly from the internet, often protected by weak or default passwords.

Once inside, attackers changed passwords and network settings to lock operators out of their own equipment. According to a July 30 alert from the Cybersecurity and Infrastructure Security Agency, this activity led to boil water notices and forced utilities into sustained manual operations. CISA also warned that the attackers were going after water systems of every size.

Why Small Towns Are the Weak Link

NIST points out that the U.S. has nearly 50,000 community water systems, and more than 80% of them are small, each serving 3,300 people or fewer. Those small utilities rarely have dedicated cybersecurity staff or the budget to hire them.

That’s not a knock on the operators. A rural plant might have two or three people running everything, and remote access is what lets them check a pump station 20 miles away at 2 a.m. That same convenience is exactly what attackers are scanning the internet for.

NIST’s own conclusion is blunt: even utilities with solid protections may still see service disruptions during an attack. The difference is how fast they recover. Your job is to be ready for that gap.

What a Water Hack Looks Like at Your Tap

So far, officials in the affected towns said the drinking water stayed safe, and crews kept things running by hand. That’s the good news. The bad news is that a hack can still hit your household in three ways.

First, a boil water notice. If operators lose control of treatment or monitoring, they may issue a precautionary advisory until they can confirm the water is safe.

Second, low pressure or no water at all. If pumps get knocked offline or operators have to shut systems down, your taps can run dry for hours or days.

Third, the scenario officials worry about most: tampered treatment settings. CISA warns that internet-exposed control equipment faces a higher risk of unauthorized configuration changes and, in severe cases, physical damage.

Store Enough Water to Ride It Out

The CDC recommends storing at least 1 gallon per person per day for 3 days, and a 2-week supply if you can manage it. For a family of four, two weeks means 56 gallons. Store extra for pregnant women, anyone who is sick, pets, and hot climates.

Unopened commercial bottled water is the simplest option. For bulk storage, food-grade containers like the Reliance Aqua-Tainer 7-gallon jug stack well and have a spigot, so you never dip into the water and contaminate it. Label each container with the fill date and replace home-filled water every six months.

If you get advance warning of trouble, a bathtub bladder like the WaterBOB emergency storage bladder lets you capture up to 100 gallons of clean tap water while it’s still safe. And don’t forget the dozens of gallons already sitting in your water heater.

Know How to Treat Water When the Notice Comes

When a boil water notice hits, the CDC’s rule is simple: bring clear water to a rolling boil for 1 minute, or 3 minutes above 6,500 feet. Use boiled or bottled water for drinking, brushing teeth, washing produce, making ice, and mixing baby formula.

No power or fuel to boil? Plain unscented bleach with 5% to 9% sodium hypochlorite works: 8 drops per gallon, doubled for cloudy water, then wait 30 minutes. Chlorine dioxide tablets such as Katadyn Micropur MP1 make a lightweight backup, and the CDC notes chlorine dioxide also kills Cryptosporidium when used as directed.

One hard limit: boiling and disinfecting can’t remove fuel or toxic chemicals. If officials ever say treatment chemicals were tampered with, use only stored or bottled water until they give the all-clear.

Make Sure the Warning Actually Reaches You

A boil water notice does nothing if you never see it. Sign up for text or phone alerts from your water utility today, and register for your county’s emergency notification system.

Keep your utility’s phone number written on paper, not just saved in your phone. Follow your utility and local health department on social media, since updates often land there first. Keep a charged portable power bank on hand so your phone doesn’t die halfway through an outage.

Talk to your neighbors, too. A few households trading information will usually beat waiting for the evening news.

The Bottom Line

Federal agencies are working with utilities to lock down these systems, and NIST has released new guidance to help them do it. But hardening thousands of small utilities will take years, not weeks.

Water is the one prep you can’t afford to skip. Store it, know how to treat it, and make sure the warning reaches you before you fill your next glass.

You may also like:

The $5 DIY Water Filter (VIDEO)