Hackers broke into the Coweta County Water and Sewerage Authority's control systems on July 27, changing passwords and locking operators out of equipment that manages valves and pump stations. The utility's IT team discovered the intrusion after losing communication with its programmable logic controllers, and staff switched the water system to manual operations to keep service running.
Coweta Water and Sewerage Authority spokesperson Jay Boren said the attackers accessed the system through cellular channels, and that new passwords have since been set up, according to Atlanta News First. Boren said there were no water quality concerns and no indication that customer data was impacted or compromised. The identity of the attackers has not been determined, and the authority has not notified customers of the breach, per the same report. Water service itself was not interrupted, the outlet noted.
Same Week, Two More Georgia Utilities Hit
Coweta County was not alone. The Clayton County Water Authority was also impacted by a cyberattack around the same date, Atlanta News First reported, and in a separate incident reported by FOX 5 Atlanta, a Clayton County pump station failed around 1 a.m. on July 27, dropping water pressure and triggering a precautionary boil water advisory for parts of its 300,000 customers.
Columbus Water Works in western Georgia confirmed it detected a cyber intrusion into its systems in late July as well, according to a WTVM report cited by Atlanta News First. As reported by WSB-TV, the utility maintained that its drinking water supply remained uncompromised. That puts the tally at three Georgia water systems hit during the same window: Coweta County, Clayton County, and Columbus.
Part of a Wider National Campaign
The Georgia incidents line up with a much larger pattern. Federal authorities confirmed that cyberattacks targeting municipal water and wastewater utilities spanned at least seven to 12 states in late July, including Minnesota, where more than 30 facilities were targeted, as well as Michigan, Wisconsin, North Carolina, and Georgia, according to CBS News.
In a joint alert issued July 30, the FBI and EPA warned critical infrastructure operators that malicious cyber actors have been targeting internet-exposed Rockwell Automation and Allen-Bradley programmable logic controllers, remotely changing IP addresses and passwords to lock operators out of water system controls — the same type of equipment and tactic described in the Coweta County breach. A separate CISA advisory issued the same day explained how these intrusions often happen: cellular modems installed on industrial controllers create unmonitored backdoors that bypass internal network firewalls, letting remote attackers alter configurations without appearing on internal network scans, as reported by Censys.
A Sector With Known Weak Points
The vulnerability isn't new. An EPA enforcement alert issued in May 2024 found that more than 70 percent of inspected U.S. community water systems failed to comply with basic Safe Drinking Water Act cybersecurity requirements, frequently leaving default passwords unchanged and remote logins unencrypted, per the EPA. Under Section 1433 of the Safe Drinking Water Act, community water systems serving more than 3,300 people are required to conduct risk and resilience assessments and update emergency response plans every five years to address physical and cyber threats.
Investigators looking into the July 2026 wave of attacks have noted potential Iranian linkages, building on a late 2023 case in which the Iranian IRGC-affiliated group known as CyberAv3ngers hacked Israeli-made Unitronics controllers at water facilities, including the Municipal Authority of Aliquippa in Pennsylvania, according to The Current. Whether this latest campaign will be formally attributed to a specific nation-state actor remains an open question.
A Growing System Under Scrutiny
The Coweta County Water and Sewerage Authority serves more than 31,000 active water customers and operates the B.T. Brown Water Treatment Plant, which has a daily treatment capacity of 10 million gallons, according to the authority's own records. The system has also been in expansion mode: in February, federal officials announced a $4.75 million federal investment for the authority to build Phase II of the Chattahoochee Raw Water Transmission Main and a new raw water pump station to support rapid population growth in the area, per the office of Congressman Brian Jack.
That growth adds urgency to questions about how well-protected the expanding infrastructure will be going forward. Whether Coweta County has fully removed cellular backdoors from its systems has not been publicly detailed, and local officials have not said how they plan to secure new infrastructure as more federal funding flows into the utility's expansion projects.
