Hackers Hit Two New Jersey Water Systems. Here's What It Means for Your Tap

State officials confirmed this week that two New Jersey municipal water systems were targeted in cyberattacks believed linked to Iran. Water stayed safe and service never stopped, but the incident is a reminder that the systems behind your tap are more exposed than most homeowners realize.

What Actually Happened

New Jersey's Office of Homeland Security and Preparedness said this week that hackers remotely accessed internet-connected devices controlling two municipal water systems, altering IP addresses and passwords tied to the equipment. The intrusions happened in the last week of July and disabled the utilities' ability to remotely monitor and manage parts of their systems. Neither utility has been publicly named, which is standard practice for active security incidents involving critical infrastructure.

Investigators believe the activity is part of a wider wave of attacks that reached water and wastewater operators in at least a dozen states, and officials say Iran is the leading suspect, though they have not ruled out another actor mimicking Iranian tactics. The FBI had already flagged heightened risk to the water sector in a July 30 alert, so New Jersey's cybersecurity team was watching for exactly this kind of activity when it surfaced.

Why Your Water Never Stopped

The reason this story is not a bigger one is straightforward: water utilities build for exactly this failure mode. When the automated control and monitoring layer goes dark, trained operators can run treatment and distribution manually, checking pressure, chlorine residual, and flow by hand instead of by dashboard. Both affected utilities did exactly that, quickly shifting to manual control, and officials confirmed customers had uninterrupted access to safe drinking water the entire time.

That manual fallback is also why an event like this looks completely different from a water main break or a boil water advisory. A cyberattack on control software does not put anything into the water itself. The risk it creates is operational, not chemical, and it is the kind of risk utilities drill for specifically because remote systems can and do fail, whether from a hacker, a storm, or a hardware glitch.

What This Means for a Homeowner or Business Owner

There is no faucet-level fix for a utility's cybersecurity, and that is not the point of this story for a homeowner. The real takeaway is that the systems behind your water supply are more complex, and more exposed to outside interference, than most people think about until something like this makes the news. Utilities are being pushed toward multifactor authentication, disconnecting unnecessary internet-facing equipment, and faster incident response, and that work happens on their side.

What is worth doing on your side is making sure your own household is not caught flat-footed by any disruption to water service, cyber-related or not: know where your main shutoff valve is, keep a case of bottled water on hand the way you would for a storm, and have a plumber's number saved before you need it rather than while a boil water notice is already active. Plumbarama's crews field calls around the clock for exactly those moments, whether the cause is a cracked main, a failed water heater, or an advisory that has everyone on a block boiling their tap water at once.

5 Ways to Water-Proof Your Household Against Any Disruption

Cyberattack, storm, or a plain old main break, the prep is largely the same. These are the basics worth having in place before you need them.

1. Know your main shutoff valve: If pressure drops or discolored water starts flowing, being able to shut off your line fast can prevent damage inside the house.
2. Keep a few days of bottled water on hand: The same stash you'd keep for a storm covers you for a boil water advisory or a utility outage without a special trip to the store.
3. Save a 24/7 plumber's number now, not during a crisis: Advisories and outages tend to spike call volume everywhere at once. Having a trusted number already saved means you are not searching mid-emergency.
4. Ask your municipality how it would notify you: Most towns push boil water and service alerts by text, email, or reverse-911. Confirm you are actually signed up before you need the notice.
5. Don't ignore sudden pressure or discoloration changes: Either can be an early sign of a main issue, whether from mechanical failure or a system running in manual mode. Report it to your utility and check your own fixtures.

Frequently asked questions

Was any New Jersey drinking water actually contaminated?

No. Officials said there was no contamination and no disruption to service at either affected utility. The attacks disabled remote monitoring and control systems, not water quality itself.

Which two water systems were hit?

State officials have not publicly named the affected utilities, which is standard for ongoing security incidents involving critical infrastructure.

Could this happen to my town's water system?

The FBI has warned that many water and wastewater utilities nationwide have internet-exposed control systems that could be similarly vulnerable, which is why the sector is being pushed toward stronger access controls and network segmentation.

What should I actually do differently at home?

Nothing changes about your day-to-day water use. It is simply a good prompt to know your shutoff valve, keep a little emergency water on hand, and have a plumber's number ready before any advisory or outage happens.