Overview:
- Nine Michigan water systems experienced cyber intrusions this summer in a wave of attacks affecting at least 12 states, with federal investigators suspecting Iran-backed hackers.
- Michigan's 1,400 water and waste systems are no longer overseen by the commission that regulates the state's gas and electric utilities.
- The Michigan Public Service Commission should coordinate voluntary cybersecurity services for water systems, especially smaller communities that cannot afford individual consultants, says Michigan Forward founder Brandon Jessup.
In late July, hackers breached operational technology at water and wastewater systems across the United States.
By the time Minnesota officials went public about attacks on more than 30 of the state’s water systems, President Donald Trump had already decided who was responsible — not Iran, not aging infrastructure, not a decade of federal underinvestment, but Minnesota’s governor, whom he called “grossly incompetent” and “corrupt.”
The Federal Bureau of Investigation and Environmental Protection Agency’s findings would soon conflict with Trump’s deflection.
Water and wastewater utilities in at least seven states had reported cyber intrusions since July 27, the federal agencies said in a July 30 statement.
Days later, 12 states, including Michigan, were reporting multiple municipal water systems that were affected, CBS News reported Aug. 6. Federal investigators suspected Iran-backed hackers, but did not officially state this, the report said.
A former FBI cyber expert told PBS: “I would be shocked if Iran wasn’t behind this attack.”
In one example of the disruptions, Georgia’s Clayton County Water Authority issued a boil water advisory impacting parts of its roughly 300,000-person service area outside Atlanta after a drop in water pressure — and said unauthorized cyberactivity could be the cause of the problem.
This is not a Minnesota problem. This is the symptom of a larger, national scale; the Great Lakes State should collectively treat it as such.
Michigan regulates a mix of 1,400 municipal and community water and waste systems. Nine of them reported cyber activity consistent with the federal warnings this summer.
The Michigan Cyber Command Center coordinates incident response. It works alongside the state’s environmental regulator, the FBI, and federal cybersecurity agencies on water sector threats.
State officials say no drinking water was compromised. But Michigan’s own utility regulator, the Michigan Public Service Commission (MPSC), is not included in the equation. This creates a regulatory gap that leaves our community water and waste systems exposed.
The agency Michiganders trust to keep their electricity and natural gas running safely, the MPSC, once had jurisdiction over water utilities. The Michigan legislature rolled back this authority in 1995. This change was made without the benefit of hindsight about what an internet-connected water infrastructure would look like three decades later.
Every state relies on the federal government to provide strong infrastructure to meet the scale and diversity of the country’s water utilities.
Congress allocated $2.76 billion toward the Environmental Protection Agency Clean Water and Drinking Water State Revolving Funds in fiscal 2026. These funds support community infrastructure improvements recommended by state and federal cybersecurity agencies.
The Cybersecurity and Infrastructure Security Agency is a federal agency charged with coordinating responses to water sector intrusions. Nearly 1,000 employees have left since early 2025, according to the Cloud Security Alliance.
A $707-million cut to the agency is proposed in the fiscal 2027 federal budget, and it would eliminate core regional field adviser roles designed to assist smaller water systems to strengthen their water security, according to the alliance.
Michigan cannot lobby away this policy reality at home. Our water security is built on intelligence and coordination.
Security is a collective action. Coordination is core to protecting Michigan’s water systems.
Michigan’s municipal electric utilities exhibit a strong working model through associations like the Michigan Municipal Electric Association and the American Public Power Association. These organizations comprise dozens of small, independently run public power systems pooling cybersecurity resources.
These actions — threat intelligence, monitoring, and incident response — are shared through cooperative arrangements rather than each municipality building and sustaining its own security operation from scratch.
Michigan’s water systems are long overdue for a similar framework.
The MPSC is a natural body to serve as a voluntary coordination hub for shared threat intelligence and joint technology procurement, with a direct channel to Michigan’s cyber command center and federal partners.
Communities like the one where I live — Center Line — can’t afford a cybersecurity consultant, but a shared service could support the hundreds of independent communities like it across the state.
State agencies such as the MPSC shine when they serve as the connective tissue between the thousands of communities that make up Michigan. This is a prime opportunity to learn lessons from this summer’s cyberattacks: Michigan should not let any individual town stand alone against any rogue nation-state, and no individual town can sustain the effects of drastic federal budget cuts.
Blaming any one actor, while ignoring nationwide vulnerability, builds upon the ignorance these cyberattacks are made to exploit.
Real resolution centers the safety and security of our water systems. Michigan has core pieces to build a better security infrastructure: water sector expertise, a cyber command center, and a commission with decades of experience coordinating the regulation of public utilities.
The Michigan Legislature should act to authorize and appropriate funds for the MPSC to formally coordinate and operate a voluntary cybersecurity coordination program. This will allow communities and the state to strengthen the connective tissue between municipalities before the next wave of cyberattacks reaches our taps.
Planet Detroit’s Voices column includes opinion pieces from our community of partners and readers. These pieces express the voices of the authors and not necessarily those of the publication.
MORE PLANET DETROIT VOICES
Voices: What Detroit’s flooding crisis reveals about building resilient Great Lakes cities
A major federal study is examining Detroit’s flooding crisis. The solutions must prioritize neighborhoods that have borne the brunt of aging infrastructure and climate change, say Tiana Starks and Sara Hughes.
Wildfire smoke may have cleared, but mental health impacts can linger
As wildfire smoke events become more frequent in Michigan, mental health professionals are seeing increased anxiety, grief, and anger among residents—especially young people concerned about their future.
Voices: Detroit’s DTE shutoff crisis has a face, and it looks like mine
Why does Detroit face 17 times more utility shutoffs than Ypsilanti? An energy justice organizer examines DTE’s disconnection crisis and its racial dimensions.
