New Jersey cyberattacks put U.S. water systems on alert

Two New Jersey water utilities were targeted in a broader wave of cyberattacks that has hit systems in at least a dozen states, prompting emergency guidance from federal agencies. Water quality strategist Heather A. Kollar says the incidents show how quickly treatment chemistry, public confidence and health protections can be put at risk.

Why it matters: - Water systems are part of critical infrastructure, and cyberattacks on treatment controls can change what comes out of the tap. - New Jersey officials confirmed two municipal utilities were hit over the past week, and the wave has now reached at least a dozen states. - Federal agencies have responded with emergency guidance from the Cybersecurity and Infrastructure Security Agency, the FBI and the EPA. - No contamination has been confirmed in any state, but the attacks show how quickly utilities may need to switch to manual operations.

What happened: - Two municipal water utilities in New Jersey were cyberattacked over the past week. - Hackers gained access to internet-exposed control systems in both New Jersey cases. - Staff shifted to manual operations, and customers kept uninterrupted access to safe drinking water. - Heather A. Kollar, managing partner of H2OCleanse and a drinking water quality strategist, said the attacks expose how fragile water quality can be. - Kollar warned that hacking water treatment facilities could trigger “another Flint-like crisis.”

The details: - Water treatment depends on chemical dosing for chlorine or chloramine, pH adjustment with lye, and corrosion control to limit lead and copper leaching. - Those processes run through programmable logic controllers, which CISA says were the entry point for the recent attacks. - Kollar said the risk runs both ways: too much of a chemical can be dangerous, and too little can also create harm. - In Oldsmar, Florida, in 2021, a hacker briefly raised lye levels roughly 100-fold before an operator caught the change. - In Flint, Michigan, the city changed water sources without adjusting corrosion control, and lead leached into the supply for more than a year before the crisis became public. - Kollar said Flint was caused by negligence and a chemistry mistake, not hackers. - Food & Water Watch’s “Take Back the Tap” report found roughly 64% of bottled water sold in the U.S. comes from municipal systems. - The report also found much bottled water gets minimal added treatment and is often sold in plastic that sheds microplastics. - Kollar said bottled water is best used as an emergency bridge, not as an everyday substitute for tap water. - In Jackson, Mississippi, in 2022, a treatment plant failure left more than 150,000 residents without water from the tap for weeks. - Just last month, the Hackettstown Municipal Utilities Authority issued a system-wide boil water advisory after E. coli was found in a well, affecting five municipalities across two counties. - Kollar said water quality changes without warning and people may get a notice only after a problem has already started. - Kollar recommends highly certified point-of-use filtration. - Kollar said solid carbon block filtration fits about 85% of U.S. communities and can remove PFAS, microplastics and pathogens while preserving minerals and avoiding water waste. - Kollar said communities with naturally occurring radioactive contaminants such as uranium, or high nitrate levels seen in parts of Connecticut, are better served by reverse osmosis. - Kollar advocates making certified filtration standard in building code. - Clean Water Champs, the community Kollar leads, focuses on water quality education and stewardship. - The announcement directs readers to More information. - The announcement also includes Kollar’s LinkedIn profile at Heather A. Kollar on LinkedIn.

Between the lines: - The immediate threat in New Jersey was contained, but the broader risk is systemic: aging water infrastructure now has to defend against both physical failures and digital intrusion. - The article argues that household preparedness matters because utility notices, advisories and cyber incidents may arrive after water quality has already changed. - Kollar’s pitch centers on prevention at the tap, not panic buying after an alert.

What's next: - Utilities are likely to keep tightening cybersecurity and moving vulnerable control systems away from direct internet exposure. - Public attention may increase around filtration standards, building codes and consumer water preparedness. - Emergency advisories and additional state or federal updates may follow as agencies assess the scope of the attacks.

The bottom line: - The recent cyberattacks did not contaminate drinking water, but they exposed how quickly water safety can be disrupted and why filtration, monitoring and infrastructure hardening are becoming harder to ignore.