US government says Iran-linked hackers are disrupting American water and energy providers

The FBI, NSA, Energy Department, and CISA didn't issue a warning. They issued a confession: Iranian-backed hackers are already inside American industrial control systems, rewriting the logic that keeps water flowing and power stable. This isn't a scan. It isn't a probe. They changed the programming on programmable logic controllers to disable critical shutdowns and alarms, letting systems drift into unsafe conditions without operators knowing. That sentence should stop every reader cold.

The advisory names names now. Rockwell Automation controllers were the first identified target. Schneider Electric and Siemens have been added. The agencies warn that potentially every internet-exposed industrial controller is vulnerable. That's not a theoretical risk — that's an architecture indictment. Critical infrastructure in this country was never designed to face nation-state adversaries on the public internet. It was built for reliability, not resilience. The Iranians know it. They're exploiting the gap between how these systems were engineered and how they're actually deployed.

This campaign has been escalating since February. The same Iranian actors who leaked FBI Director Kash Patel's personal email — a classic espionage flex — pivoted to wiping tens of thousands of devices at Stryker, a medical technology giant. Handala, the hacking group claiming credit, also took responsibility for breaching Cal Water in June and boasted they could have disrupted the supply. Cal Water denied operational network compromise. But the pattern is clear: Iranian state hackers are moving from steal-and-leak to break-and-hold. They're learning the terrain. They're testing the levers.

The advisory's language is deliberate: "conducting this activity to cause disruptive effects within the United States." Not espionage. Not intelligence gathering. Disruptive effects. That's a threshold-crossing statement from agencies that typically bury intent in bureaucratic euphemism. They're saying the quiet part out loud because the evidence forced them to. A critical infrastructure provider — unnamed, of course — was caught with its safety logic disabled. That's not a near-miss. That's a hit.

Owners and operators are being urged to act. Pull controllers off the internet. Enforce multi-factor authentication. Segment networks. Monitor for unauthorized logic changes. Standard hygiene, years overdue. But hygiene doesn't fix architecture. The hard truth is that thousands of water treatment plants, pump stations, and substations run on equipment that was never meant to face a determined adversary. Patching the exposure is triage. The patient still has a compromised immune system.

Skepticism is warranted on some claims. Handala's boast about Cal Water came without evidence. Iranian proxy groups exaggerate for propaganda value. But the joint advisory isn't based on Handala's press releases. It's based on forensic intrusion analysis across multiple victims. The controller manipulation — disabling shutdowns and alarms — is a specific, verified technique with dangerous intent. That's not theater. That's tradecraft.

The war context matters. Since February, Iranian hacking has accompanied the broader conflict involving Iran, the U.S., and Israel. Cyber operations have ranged from typical espionage to the Stryker wipe to the Cal Water breach attempt. Now: direct manipulation of safety-critical logic at U.S. water and energy providers. Each step tests U.S. response. Each step normalizes deeper intrusion. The adversary is calibrating.

American critical infrastructure defense remains fragmented. Sector-specific agencies issue advisories. Private owners operate the assets. No single authority can mandate the architectural overhaul this moment demands. The Iranians exploit that fragmentation. They don't need to hack every provider. They need to hack enough to prove the concept, then hold the risk as deterrence or escalation leverage. The advisory confirms they've reached the proving stage.

This won't be the last advisory. The target list will grow. The techniques will refine. The question isn't whether Iranian state hackers can disrupt U.S. water and energy — they've demonstrated they can. The question is whether the United States can muster the political will and regulatory authority to fix the underlying rot before the disruptive effects become destructive ones. The controllers are exposed. The logic is rewritable. The safety systems are disableable. The clock is running.