In late July 2026, coordinated attacks hit operational technology at more than 30 community water systems in Minnesota. Within days, Michigan had identified nine more. The FBI reported related incidents across at least seven states. Confirmed effects included loss of pressure, flooding, communications outages, and boil-water notices. In Braham, Minnesota, attackers got into the controls for the city’s well and treatment plant and briefly locked operators out of their own system.
CISA called it a “significant escalation” and told utilities to pull exposed PLCs off the public internet. That’s the right call, and every water utility in the country should be reading that advisory right now.
Here’s the thing: all of that reporting is about the network. Almost none of it is about the fence line.
A water system isn’t one building. It’s dozens of them, and most are empty.
When people say “water treatment plant security,” they usually picture the main facility — the headworks, the filtration building, the chlorine room. That’s one site. A typical community water system also runs remote well fields, lift stations, elevated tanks, and chemical storage yards scattered across the service area, and almost none of them have a person standing in them most hours of the day.
That’s the part the OT security conversation doesn’t capture. A utility can harden every PLC it owns and still have a pump station three miles outside town with a cut perimeter fence and no one finding out until the next scheduled site visit.
Copper theft, not cyberattacks, is what most utilities deal with weekly
The United States has roughly 152,000 public drinking water systems and more than 16,000 wastewater systems, and over 80% of the country gets its drinking water through them. Almost all of that infrastructure sits outdoors, unattended, in places chosen for hydraulic reasons, not visibility.
The threat that shows up there most often isn’t a nation-state actor. It’s someone with bolt cutters going after copper wiring in a pump motor or grounding system. It’s vandalism at a remote tank. It’s someone testing a gate at 2 a.m. because no one is around to stop them. None of that makes the news. All of it takes a facility offline.
A camera that only records is a camera that only tells you what already happened.
What “water treatment plant security” actually means
Ask most people to define it, and you’ll get some version of: fences, locks, and a few cameras at the main plant. That’s the textbook answer, and it’s also the version of security that federal law says isn’t good enough anymore.
Under Section 2013 of America’s Water Infrastructure Act, every community water system serving more than 3,300 people has to complete a risk and resilience assessment covering physical barriers, malevolent-act risk, and the security of its electronic and automated systems — and recertify it every five years. That assessment has to account for every facility in the system, not just the one with a name on the building.
Real water treatment plant security means the same standard of coverage at the unmanned well field that you’d expect at the main plant. Most utilities aren’t there yet, and the assessment cycle is exactly when the gap gets found.
Where the site inventory usually breaks down
- Treatment plants — staffed at least part of the day, but often only one entry point is actually watched
- Pump and lift stations — the largest count of sites in any system, almost never staffed, frequently without reliable power or connectivity
- Elevated tanks and remote reservoirs — high-value targets for vandalism, usually the last thing to get a camera budget
- Chemical storage yards — the highest-consequence site type if someone gets in, often protected by nothing more than a padlock and a sign
Each of these categories has a different risk profile. Treating them as one line item in a security plan is how gaps get missed.
Where it goes sideways and the actual fix
- Copper theft goes undetected until the pump fails. Fix: continuous monitoring with motion-based alerts at the exact panels and enclosures thieves target, not just a wide static shot of the yard.
- Remote sites have no power or connectivity for cameras. Fix: solar-powered units built for exactly this — no trenching, no utility hookup, deployable at the well field or the tank as easily as at the main plant.
- Nobody’s watching the footage in real time. Fix: TrueLook’s AI-based security detection monitors after hours and notifies the team when a person or vehicle is present where none should be, and can reach out to authorities instead of waiting for someone to review hours of recorded video after a theft is already reported.
- No documentation when something goes wrong. Fix: time-stamped video tied to the exact incident, which is what an emergency response plan and an insurance claim both actually need.
That gap — cameras that only prove a break-in happened instead of stopping it or catching it live — is where most utilities’ water treatment security actually fails today. Closing it doesn’t mean ripping out existing equipment. It means adding real-time detection and remote visibility to the sites that currently have neither. Talk to TrueLook about securing every site in your system →
Frequently Asked Questions
No. AWIA Section 2013 requires a risk and resilience assessment covering physical security and resilience, but it doesn’t mandate specific equipment. The assessment is what typically surfaces the gap between the main plant and the unmanned sites.
Every five years, for community water systems serving more than 3,300 people, per EPA’s implementation of AWIA Section 2013.
Yes. Solar-powered, cellular-connected camera systems are built for exactly this scenario and are common at construction and utility sites with no existing infrastructure.
A standard camera stores footage for someone to review later, usually after an incident is reported. An AI-monitored system flags unusual activity — a person or vehicle where none should be — in real time, so someone can respond while it’s happening instead of after.
The bottom line on water treatment plant security
The cyberattacks making headlines this year are real, and hardening the network matters. But most of what happens at a water utility is physical (the cut fence, the stripped copper, the tank nobody checked on for a week) and never touches a PLC at all. It happens at sites the security plan barely covers, because they don’t look like the kind of place that needs watching.
That’s the piece I think about most: the facility with the most attention is rarely the one with the most exposure.
If your system includes remote pump stations, elevated tanks, or chemical storage sites that don’t have real-time monitoring today, let’s talk about what full-site water treatment security actually looks like across every facility you operate, not just the main plant.
