Michigan's water utilities are under the microscope after a cyberattack hit operational technology nationwide. State agencies are now offering free cybersecurity risk checks to help utilities shore up defenses and protect residents.
Michigan's water utilities are dealing with a new kind of threat. A recent cyberattack targeted operational technology at water systems across the country. The Michigan Department of Environment, Great Lakes, and Energy (EGLE) says the attack set off a weeks-long investigation. Officials worked to figure out which utilities were hit and which might still be at risk. Michigan was one of several states affected, along with Minnesota, Georgia, and Wisconsin. The summer campaign of attacks reached more than 30 community water systems nationwide, according to Reuters and federal agencies.
Michigan has always prepared for emergencies like floods and tornadoes. Now, digital threats are forcing a change in how the state plans for disasters. Hospitals, distribution systems, and water utilities have all been targeted by cybercriminals in recent years. This raises the stakes for public safety and keeping infrastructure running. In early September 2026, two small private water systems in Colorado were hit by cyberattacks. Hackers changed equipment settings, shut off remote access and alarms, and altered pump cycles. The incidents were short and did not stop water delivery or threaten public safety. Still, they showed how exposed operational technology (OT) systems can be in this sector, according to SecurityWeek.
State response and free assessments
EGLE runs drinking water and wastewater operations across Michigan. The agency has started putting money into both physical and cyber defenses at water utilities. Since 2023, EGLE has reached out to utilities to help them get ready for cyberattacks. The agency works with the Michigan State Police, the Environmental Protection Agency, the Michigan Department of Technology, Management, and Budget, and the Critical Infrastructure Security Administration. Together, they now offer free cybersecurity risk assessments for drinking water and wastewater treatment plants. Local governments, including the City of Farmington and Oakland County emergency management, are part of this effort to make sure everyone is on the same page.
The risk assessments help utilities find weak spots and build response plans that work across city and county lines. EGLE Emergency Management Coordinator Jay Eickholt has called on all critical infrastructure sectors to team up with emergency management and security officials. The goal is to build strong response strategies that protect both people and the environment. The Farmington Public Schools board has also been briefed on why cybersecurity matters for facilities and student safety. This shows how connected local infrastructure really is.
Training and resources for utilities
EGLE is not stopping at risk assessments. The agency keeps working with state and federal partners to offer training and education for regulated facilities. EGLE has launched an updated emergency planning and preparedness webpage. It gives residents, local officials, and industry partners resources to improve their planning and response. Utilities can find more details on the Cybersecurity Assessments webpage run by EGLE.
Michigan's approach is part of a bigger shift in how states protect infrastructure. Digital threats now disrupt services as much as physical disasters. The state's focus on teamwork and readiness is meant to make sure all utilities, no matter their size or location, have the tools and know-how to fight off new cyber risks. A September 2026 study by SpyCloud found that nearly 1,800 U.S. water and wastewater organizations showed signs of exposure to infostealer malware. More than 250 had stolen credentials tied to OT or remote access systems. These numbers do not confirm breaches at Michigan utilities, but they show how big the problem is for the whole sector.
Context and ongoing developments
Michigan is not alone. States everywhere are facing the same cybersecurity challenges as attacks get more complex and frequent. The recent attack on water utilities shows why agencies and operators need to work together and share information. The Governor of Colorado's office reported ongoing attempts by a group said to be linked to Iran to break into water and wastewater systems across the country. Attribution is still being investigated. As covered in a recent article, Michigan's growing network of data centers and digital infrastructure has put the state at the center of national talks about cyber resilience.
EGLE's push for free assessments and training shows that cybersecurity is now a basic part of public safety. The agency's work with law enforcement and federal regulators is about staying ahead of new threats, not just reacting after something goes wrong. As digital risks keep changing, Michigan's utilities and public agencies-including the City of Farmington Hills and Oakland County-will have to stay alert and keep updating their plans to protect essential services for everyone.
