This Tenable research brief traces the escalation timeline behind the year's water sector attacks, noting that in June 2026, US strikes on Iranian territory near the Strait of Hormuz destroyed a water facility, cutting service to more than 20,000 Iranians. The Handala group, linked to Iran's Ministry of Intelligence and Security, claimed retaliatory breaches of US water infrastructure the following day.
The brief places this within the context of an active armed conflict between the US and Iran that began in February 2026, noting that Iranian cyber operations have escalated in parallel with kinetic hostilities, with confirmed targeting of US critical infrastructure as a declared response pattern rather than isolated opportunistic activity.
It emphasizes a structural sector vulnerability directly relevant to most water utility readers: small and mid-sized utilities typically lack dedicated OT security staff and operate under constrained budgets, making comprehensive security architecture difficult to implement even when specific threat intelligence about targeting is publicly available in advance.