Loading story…
The Trump administration launched Project Watershed 250, a six-month pilot to identify and remediate cybersecurity weaknesses at Texas water and wastewater utilities. Led by the Office of the National Cyber Director and Texas Cyber Command, with participation from the Texas governor’s office, EPA, CISA and private companies, the program will provide participating utilities no-cost assessments, red-team testing, system hardening and AI-enabled defensive tools.
The initiative follows persistent threats to U.S. water infrastructure, including an Iranian-backed campaign that affected roughly 30 systems across 12 states and a suspected Russian-linked 2024 intrusion at Muleshoe, Texas. Officials said the pilot is designed as a collaborative, industry-led alternative to withdrawn federal audit requirements and could become a model for a nationwide water-sector cybersecurity program.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
Iranian hackers reportedly shut down an unnamed UK power plant for several days in July 2026, reportedly during a broader operation targeting U.S. water plants.
Texas established Texas Cyber Command, funding it with $135 million to protect state and local government systems and coordinate cyberattack responses.
A cyberattack against the Muleshoe, Texas, water system was suspected to have been conducted by Russian hackers.
The Trump administration formally launched Project Watershed 250 in San Antonio, Texas, as a six-month pilot to identify and remediate cybersecurity weaknesses in water and wastewater systems. ONCD, Texas Cyber Command, EPA, CISA, Texas state officials, and private-sector companies are participating, with assistance provided to utilities at no cost.
After some Republican-led states challenged Biden-era water-system cybersecurity audit requirements in court, the Environmental Protection Agency withdrew the rule.
An Iranian-backed cyberattack affected 30 water systems across 12 U.S. states. Officials said affected systems continued operating safely and no known public-health effects occurred.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceinfosecurity-magazine.com
Open sourcecyberscoop.com
Open sourcenextgov.com
Open sourcegov.texas.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The White House plans to adapt **Project Watershed 250**, a Texas water-sector cybersecurity pilot, for additional critical-infrastructure sectors. National Cyber Director Sean Cairncross said the Office of the National Cyber Director will identify the sectors after assessing how the program can scale, but did not disclose a rollout timeline. Launched in San Antonio on August 31, the pilot links water utilities with government and private-sector cybersecurity support to identify and remediate vulnerabilities. The initiative is designed to address limited funding and technical expertise among water providers, testing whether industry partnerships can lower deployment costs, provide security technology, and strengthen operational defenses. Cairncross also said ONCD is developing a cyber academy proposal involving venture capital, private-sector initiatives, and a service component to expand the cybersecurity workforce.
Sep 10, 2026
New York has expanded its effort to protect drinking water and wastewater systems by pairing statewide cybersecurity requirements with more than **$9 million** in SECURE grant funding for **153** utilities. State officials said the program supports cybersecurity assessments, security upgrades, operator training, incident reporting, and risk-based protections, while requiring larger drinking water systems to designate cybersecurity leads. The initiative builds on regulations issued by the Departments of Environmental Conservation and Health and is administered through the Environmental Facilities Corporation with technical assistance for local communities. The funding push comes as U.S. water infrastructure faces heightened operational technology threats. A recent multistate campaign targeted more than 30 community water systems in Minnesota, with additional incidents reported in at least seven states including Michigan, South Dakota, and Georgia. Federal investigators have not formally attributed the activity, but Iran is considered a leading suspect because the tactics resemble earlier operations against industrial control systems and water utilities. In response, **CISA** urged operators to remove internet-exposed PLCs and strengthen remote access and password security.
Aug 5, 2026
U.S. policymakers are advancing new cybersecurity measures for the **water and wastewater sector**, with separate federal and state initiatives aimed at improving defenses for under-resourced utilities. A bipartisan federal proposal, the **FLOWS Act**, would provide the Environmental Protection Agency with **$50 million annually** to help small and rural water systems modernize cybersecurity capabilities, digital monitoring, and operational technology support without requiring local cost sharing that often blocks access to federal aid. In New York, state officials finalized what they describe as **first-of-its-kind cyber mandates** for public water systems and paired them with a **$2.5 million grant program** to support risk assessments and security upgrades. The rules establish enforceable requirements for drinking water and wastewater operators to create formal cybersecurity programs, identify risks, and implement technical safeguards for operational systems, reflecting broader concern that the water sector remains a comparatively weak point in U.S. critical infrastructure security.
Jun 30, 2026