The real issue is that internet-reachable control gear in water systems was in scope across multiple states. Most sites kept running, so the easy reading is “no outage, no problem,” but that misses that attackers were able to touch the control plane for pumps, lift stations, and plant operations.
Minnesota first reported OT targeting at more than 30 water and wastewater facilities. Michigan confirmed malicious cyber activity at a small number of communities, Rapid City reported a lift-station incident in its wastewater system, and reporting now puts at least seven states in the campaign.
For operators with exposed PLCs or remote OT access, the risk is not just service interruption. It is that shared industrial control paths can be reached and tested across many sites even when public water stays safe today.