Iranian hackers once seized a Pennsylvania water pump and left a message bragging "Down with Israel" right on the control screen.
That was 2023, and now foreign hackers just broke into two more water plants in Colorado.
What investigators found inside those Colorado systems should worry every parent in America.
Iran's Cyber Army Already Bragged about Hacking American Water Once
In November 2023, a group calling itself Cyber Av3ngers seized a pump station in Aliquippa, Pennsylvania, and defaced the operator's screen with an anti-Israel taunt.
CISA, the FBI, the NSA, and the EPA jointly confirmed the attack came from hackers tied to Iran's Revolutionary Guard.
That was supposed to be the wake-up call.
Instead, high-profile hackers have now hit more than 100 drinking water and wastewater systems across a dozen states this year alone, according to the EPA.
Colorado officials confirmed this week that hackers broke into computer systems at two more small water utilities last month.
Once inside, the hackers took over pump timing, cut off alarm systems, and rewrote equipment settings until plant staff wrestled control back.
A spokesperson for Governor Jared Polis downplayed the intrusions as short-lived and said local utility staff had things handled almost immediately.
That is the same soothing language Democrat officials reached for in July, when more than 30 Minnesota water systems got hit the same way.
Colorado hasn't named who's behind these particular hacks, and the systems involved serve barely 400 people, which is exactly the point.
Whoever did it, the playbook matches what Iran-linked hackers have run before, targeting the kind of small-town utility nobody expected anyone to bother attacking.
Three years after Aliquippa, plenty of utilities are still getting caught with the same exposed equipment.
Democrat Governors Keep Blaming Washington for Their Own Failures
When reporters asked Trump whether Iran was behind the Minnesota hacks, he refused to let Governor Tim Walz off the hook.
He told the room he blamed Minnesota itself, calling the state and its governor "grossly incompetent."
Walz shot back that Trump knew exactly who was responsible and claimed federal cybersecurity cuts left the country exposed.
The EPA's own numbers tell a different story.
Federal records show the agency has flagged more than 900 water-sector cybersecurity gaps since 2025, spread across over 650 systems, and has already closed roughly 700 of them.
On top of that, agency inspectors have run upwards of 710 risk assessments and walked nearly 16,000 utilities through hands-on cybersecurity fixes.
That is not a government abandoning water security.
That is a federal government doing the work while local utilities skip basic password hygiene and leave equipment exposed to the open internet.
Republicans in Congress have been trying to close that gap for years.
Rep. Rick Crawford pushed legislation back in 2024 to build a real cybersecurity standards body for the water sector, warning that Russia and China have already used these same tactics against American infrastructure.
Democrat governors would rather hold press conferences blaming Trump than secure their own pump stations.
Senate Democrats like Adam Schiff and Amy Klobuchar didn't unveil their own water cybersecurity bill until August 2026, months after Republicans like Crawford were already pushing fixes through the House.
Funny how the urgency only shows up once the cameras are rolling on a Democrat governor's mess.
Iran already showed America exactly what it's capable of, right down to bragging about it on the screen.
These are rural systems running cellular-connected pumps that nobody ever bothered to lock down, exactly the kind of soft target a terror regime looks for.
Trump's team has spent three years telling utilities to pull that equipment off the open internet, and every fresh breach proves how many towns ignored the warning.
This isn't a partisan talking point, it's math.
The two governors doing the most public complaining about Washington, Walz and Polis, are both Democrats whose own states just got popped.
The next attack is already loading somewhere in Iran, and the only real question left is whether the next Democrat governor fixes his systems before it makes the news or after.
Sources:
- Morgan Phillips, "Foreign hackers breach two more US water utilities, threaten safety of Colorado residents," Fox News, September 18, 2026.
- FOX 9 Staff, "Trump blames Minnesota's 'gross incompetence' for cyberattack on water systems, not Iran," FOX 9, August 1, 2026.
- Rep. Matt Van Epps, "Rep. Van Epps Discusses Growing Cyber Threat Against Water Infrastructure," House Science, Space, and Technology Committee press release, May 21, 2026.
- Cybersecurity and Infrastructure Security Agency, FBI, NSA, and EPA, joint cybersecurity advisory AA23-335A on Iranian-affiliated Unitronics attacks, December 1, 2023.
- Rep. Rick Crawford, press statement on the Water Risk and Resilience Organization Act, May 16, 2024.
