CLAYTON COUNTY, Ga. — Channel 2 Action News Investigates has exclusively learned that what started as a boil water advisory is now being investigated as a part of a broader attack on the nation’s water supply.
The Clayton County Water Authority said investigators now suspect the outage that affected several water pump stations was not accidental and may have been part of a broader cyber campaign targeting infrastructure across the country.
“What we realized is that some of our pump stations went down,” said Erin Thomas with the Clayton County Water Authority.
The authority says the focus of the investigation centers on programmable logic controllers, commonly known as PLCs.
The devices are used throughout water systems to control equipment ranging from pumps to water treatment and purification operations.
“They’re the last step between you and the equipment?” Channel 2 Consumer Investigator Justin Gray asked.
“Things could get really dangerous if they were to be manipulated or attacked or disturbed,” Thomas said. “However, our team promptly were able to identify that they were down and we were able get the service restored.”
Georgia Tech cybersecurity professor Saman Zonouz said researchers in his lab identified thousands of internet-accessible controllers nationwide that are vulnerable to attack and alerted 7,000 institutions that he found away into their systems from his lab.
“They are misconfigured to be exposed to internet,” Zonouz said. “And we were able to discover them. If we are able to discover them, adversaries would be able as well.”
The FBI issued an alert warning that “malicious cyber actors are targeting operational technology devices used by critical infrastructure operators, including water systems.”
According to the alert, “water and wastewater utilities in at least seven states have reported incidents to the FBI, and some of those attacks disrupted water operations”.
Federal officials said attackers have been able to gain access when controllers are exposed online.
“We do have connectivity both internally and externally to get service to them,” Thomas said. “And so what we’re trying to figure out is was there a breach of any sort from our internal system, external system. But right now, we’re still undergoing the investigation to really figure out what happened.”
Federal investigators have not publicly identified who may be behind the attacks. However, the FBI warning expands on a spring alert that warned water utilities about threats involving the same types of devices and activity linked to Iran.
The investigation into what happened in Clayton County remains ongoing.
[DOWNLOAD: Free WSB-TV News app for alerts as news breaks]
[SIGN UP: WSB-TV Daily Headlines Newsletter]
©2026 Cox Media Group
