Hackers locked operators out of water plants across a dozen states - and the water kept flowing

The wall that was never going to hold

For years, the promise of security was a wall. Build it high enough, patch it fast enough, and the attacker stays outside. This week, across at least a dozen states, that promise met the real world.

Attackers reached the digital controls of dozens of American water systems. They locked operators out. They changed the addresses of the small computers that run the pumps. There was no single wall they climbed - there were thousands of small utilities, some with a cellular modem nobody had written down, each a door left ajar.

And still, the water kept running.

The quiet thing that saved the day

Look at what actually held the line. A Georgia utility lost water pressure, then restored service within hours. Elsewhere, plants ran by hand for a stretch. Drinking water stayed safe.

The systems that survived did not have better walls than the ones that got hit. They had something else: a person who could still turn the valve when the computer was locked. A backup of the controller’s settings, ready to wipe and restore. The break-in happened. It just did not become a catastrophe.

This is the shift the security world has been making for years, and it has a name: assume breach. Stop promising that no one gets in. Start designing for the day someone does.

Prevention says never; resilience says survive

A prevention mindset asks one question: how do we keep them out? It buys thicker walls, faster patches, more locks. All of it useful. None of it enough - because the attacker only has to find one door, and you have to guard them all.

A resilience mindset asks a different question: when they get in, how do we make it small and short? Detect it fast. Contain it so it cannot spread. Keep running on manual if you have to. Restore from a clean copy. Turn a break-in into a bad afternoon instead of a shuttered company.

Notice what CISA, the US cyber-defence agency, actually told water operators. Pull the controllers off the open internet, yes. But then: keep a known-clean backup of each one, so a locked-out operator can restore it. That is not advice for keeping attackers out. It is advice for getting back up after they are already in.

The same week, the other ending

The reverse case was there too. In one campaign, attackers phoned staff over a work chat tool, posed as tech support, and planted ransomware - software that scrambles a company’s files and holds them for money. One intrusion went from first access to encrypted files in under 17 hours.

The firms that came through it were the ones ready to recover. A financial firm called River spotted its ransomware in three days, pulled the affected servers offline, and cut off the accounts the attackers were using. A Dutch store breached through a supplier had the partner block access at once and kept its shops and website open. The break-in was not the disaster. Whether you could recover was.

Why this reaches your kitchen tap

It is tempting to file this under someone else’s problem - the utility’s, the IT department’s, the government’s. But you drink the water. You bank at the firm. You shop at the store.

The reason the tap still ran this week is not that the attackers were kept out. They were not. It ran because the systems were built to survive being broken into. That is a quieter kind of safety than a fortress, and a more honest one. No one can promise you a wall that never falls - not the utility, not the bank, not you with your own passwords and your own backups. The break-in is coming. The question worth asking is not whether it happens. It is whether the thing you depend on can take a hit and keep working.

From any single seat - one operator, one IT team, one regulator - you cannot see every exposed door. What you can build is a system that bends without breaking. This week, a lot of them did.