Volunteers patch 100 water systems against hackers

A loose network of cybersecurity volunteers has quietly stepped in to defend America’s water systems from Russian, Iranian and Chinese hackers probing for weaknesses. These experts—many retired from government or big tech—are now scanning utilities, fixing flaws and training staff, all for free, after years of warnings that critical infrastructure was dangerously exposed.

Water treatment plants, pumping stations and sewage systems have become prime targets because they’re often run by small towns or cash-strapped agencies that can’t afford full-time security teams. In 2021, a hacker breached a water system in Oldsmar, Florida, and briefly increased the level of lye to dangerous levels. Since then, probes from state-backed groups have jumped. The Environmental Protection Agency says 70% of water utilities have weaknesses that could let intruders in. Congress has failed to pass stricter rules, so experts are acting on their own.

The volunteers—organized through groups like the Water Information Sharing and Analysis Center and the SANS Institute—now cover hundreds of facilities. They use free tools to hunt for unpatched software, weak passwords and exposed controls that could let an attacker turn off alarms or tamper with chemicals. In one recent case, they found a plant in the Midwest using a default login still set to “admin/admin.” Fixing it took minutes. Utilities that accept help get no strings attached, just a quick risk report and fixes. Some plant managers resist, fearing bad publicity, but most accept once they see the scans.

What happens next depends on whether Congress finally acts. The EPA has proposed mandatory cyber rules for water systems, but the industry has pushed back, calling the requirements too costly. Meanwhile, the volunteer teams are expanding, adding more retired engineers and younger pros looking for ways to give back. For now, America’s water stays on because a few hundred people are willing to do the work for free—while the clock runs down to the next attack.