A week after a New York Times report revealed that at least 100 water systems were hacked in other states, Oregon Gov. Tina Kotek’s office told OPB Friday that hackers had gained access to an Oregon water district’s core operating technology.
State leaders wouldn’t say if the attack was linked to a swarm of cyber attacks that the Times said were initiated by hackers in Iran. Oregon is still assessing the impact of the attack, and officials contacted by OPB would not identify which water district was targeted.
The cyber attacks, first reported by the Times on July 30, targeted municipal drinking water systems in at least seven states, according to the paper.
FILE — A water tower is seen Thursday, July 30, 2026, in Plymouth, Minn. A cyberattack targeted the operating technology at over 30 water systems in Minnesota, including Plymouth's, earlier this week, state officials said.
Ellen Schmidt / AP
“The Governor takes matters of cyber security seriously, and any threats or intrusions must be investigated thoroughly in partnership with federal law enforcement to keep Oregon’s critical infrastructure secure,” a Kotek staffer said in an email, which referred any follow-up questions to federal investigators.
The Federal Bureau of Investigation’s Portland office did not answer questions from OPB about which Oregon water district might have been attacked, but linked to a July 30 FBI press release acknowledging that cyber attacks have been detected in seven states “and some of that activity degraded water operations.”
Hope Hiebert, spokesperson for Oregon Enterprise Information Services, which provides cyber security support to state agencies, also confirmed that “Oregon is aware of a July cyber incident involving unauthorized access to operational technology used by an Oregon drinking-water provider.”
“Questions about a specific local incident should be directed to the affected entity or appropriate investigative authority,” she said in an email, but did not respond when asked which district was affected.
Although her agency consults with water districts on cybersecurity and threat assessments, the state’s drinking water systems are all locally managed, she said.
OPB has reached out to some of Oregon’s more than 2,500 water districts, but so far none have confirmed that they were targeted.
Brandon Zero, spokesperson for the Portland Water Bureau, acknowledged in a statement that his agency broadly faces cybersecurity threats.
“In partnership with the City’s Information Security team and agencies like the United States Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation, the Portland Water Bureau routinely examines cybersecurity vulnerabilities to safeguard the resiliency of our system,” he said.
When asked if the water bureau had been specifically targeted in July or had seen a recent increase in threats, he responded, “We can’t comment further.”
Justin Dyke, spokesperson for the Tualatin Valley Water District, said his district has seen an increase in hacking attempts — but none successful and none that have been reported to the FBI.
Officials in Klamath Falls and Corvallis both told OPB their water districts have not seen a recent increase in attacks. Redmond and Bend officials have also not been hacked, according to a report in the weekly Bend-based newspaper The Source.
According to information posted online by the FBI, cyber attacks have targeted both drinking water and sewage systems in the affected states. These attacks have targeted devices known as programmable logic controllers, which are small computers used to operate industrial equipment.
Between July 27 and July 30, hackers were able to connect to these logic controllers via the internet, then change IP addresses and passwords “resulting in a loss of monitoring and control functionality,” the FBI said in its assessment of the situation.
“Operational effects reported to the FBI have included loss of pressure and flooding,” the agency wrote. “Pressure loss in water systems could potentially allow untreated ground water to seep into pipes.”
Dyke at Tualatin Valley Water District, which was not the Oregon district that was hacked, said water system operators are aware of cyber threats and prepare for them, while taking advantage of modern technology.
Online systems, for example, allow operators to quickly adjust flow rates and water reservoir levels when water demand fluctuates quickly, he said. If those systems go down, operators have back-up plans and make changes manually.
Those back-up plans are among the steps the FBI has encouraged water district operators to take nationwide. The agency is also encouraging water systems to limit remote access to their systems and enact a range of security protocols.
It issued those warnings after The New York Times reported that at least 100 municipalities had detected recent malicious attacks on their water systems.
At least 30 water systems were targeted in Minnesota, where one treatment plant temporarily went offline. In Georgia, one water system saw a reduction in water pressure and briefly told people to boil water as a precaution.
