The Middle East is one of the driest regions on Earth. Oil and natural gas may be abundant, but the resource most essential to human survival is frequently in short supply: water. Across the Arabian Peninsula, countries rely heavily on desalinated seawater and, in some areas, groundwater drawn from rapidly depleting aquifers. Israel is not naturally water-rich, and neither is Iran, where a worsening water crisis had already become a major challenge for the regime before protests and war consumed the country.
Iran understood years ago that water is not only a source of vulnerability at home. It is also a resource through which its enemies can be intimidated, disrupted and harmed. That strategy returned to the spotlight after cyberattacks struck water systems in at least seven U.S. states. American authorities have not formally attributed the attacks, but officials said Iran was the leading suspect. The incidents join a growing list of attacks involving water systems, including Iranian cyber operations against Israeli facilities, attacks on Israeli-made control equipment used by American utilities and strikes on desalination plants during the regional war.
“The motivation is to create fear, and the psychological element is dominant,” said Dr. Eyal Pinko, an expert on strategy, cyberwarfare and intelligence at Bar-Ilan University’s Begin-Sadat Center for Strategic Studies and a former operational division chief in the Prime Minister’s Office. “The psychological element is extremely important for generating fear and intimidation, which is a significant part of the Iranian approach, but also for achieving military, economic and diplomatic gains. It is part of their spectrum of warfare and cannot be separated from the wider war effort.”
Pinko said Iranian cyberattacks should not be viewed as isolated operations carried out by Tehran alone. “Iran does not operate by itself,” he said. “Just as in nuclear development and the missile world, there is strategic cooperation here with China, Russia and North Korea. Together, they develop tools for cyberattacks. We are facing an axis, not merely one country.”
The 2020 attack on Israel’s water system
In April 2020, ynet revealed that Iran had carried out a cyberattack against Israeli water facilities from the north of the country to the south. A Western intelligence official later told the Financial Times that the attackers sought to increase chlorine levels in water flowing to Israeli homes.
Four Israeli officials and one Western official said Iranian hackers penetrated software controlling Israeli water pumps after routing their activity through American and European servers to conceal its origin. The manipulation could have caused safety systems to shut down the pumps after detecting abnormal chemical levels, potentially leaving thousands of people without running water.
Sorek desalination plant near Palmachim
(Photo: AP)
A month later, according to foreign reports, Israel retaliated with a cyberattack that paralyzed computers at Shahid Rajaee Port in southern Iran. In July 2020, ynet reported another Iranian attempt to attack Israeli water and sewage infrastructure, this time targeting two small facilities in the Upper Galilee and Mateh Yehuda. The Water Authority confirmed the incidents but said no damage had been caused.
“These were two specific and small sewage facilities in the agricultural sector that were repaired immediately and independently by the local officials at the kibbutz and the facility, with no damage to services or actual impact,” the authority said at the time.
Iranian hackers target Israeli technology in the US
Iranian cyberattacks on water systems have not been limited to Israel. In November 2023, the CyberAv3ngers hacking group, which operates under the Revolutionary Guards’ cyber command, compromised a water facility in Aliquippa, Pennsylvania.
The campaign targeted programmable logic controllers manufactured by the Israeli company Unitronics. The devices are used to monitor and control industrial processes, including water pressure and pumping. The attack disabled automatic pressure monitoring and forced employees to operate the system manually to prevent disruption to local supply.
Water infrastructure has also become a target in physical warfare. In March 2022, Yemen’s Iran-backed Houthis launched missiles and drones toward energy facilities in Saudi Arabia, as well as the Al-Shuqaiq desalination plant on the Red Sea coast. Saudi authorities said the attack involved Iranian cruise missiles and drones. Damage was reported, but no casualties.
The pattern intensified after Israel and the United States went to war with Iran on February 28. The fighting did not remain confined to military targets and also included infrastructure, energy and water facilities. On March 7, Tehran claimed that U.S. forces struck a major desalination facility on Iran’s Qeshm Island, cutting fresh-water supplies to some 30 villages. The following day, Iran launched a retaliatory attack against a desalination facility on Bahrain’s Sitra Island.
Although the most intensive phase of the war ended in April, clashes continued. On July 18, Iran claimed that the United States had “completely destroyed” the Bonji seawater desalination facility near Jask in Hormozgan Province, cutting supplies to 20 villages. Over the following two days, Kuwait reported that Iran had twice attacked a desalination facility and a power plant.
The Gulf’s critical weakness
Water is particularly vulnerable in the Gulf because desalination is not a supplementary source but the foundation of daily life. According to a 2022 report by the French Institute of International Relations, desalinated water accounts for about 42% of supply in the United Arab Emirates, 70% in Saudi Arabia, 86% in Oman and 90% in Kuwait.
Hundreds of desalination plants line the Persian Gulf and nearby coasts. Their concentration allows enormous cities to exist in places with little natural fresh water, but it also creates strategic targets whose disruption could rapidly affect millions of people.
The latest attacks in the United States affected water systems in at least seven states, with Minnesota the first to disclose the incidents and Michigan later reporting similar activity. Authorities have not yet officially confirmed Iranian responsibility. President Donald Trump played down the incident and claimed Minnesota was behind the attack, but U.S. officials said Iran remained the likely suspect.
“The attacks are not unusual,” Pinko said. “Iran operates several attack groups in this field.” He said two major bodies oversee Iranian cyber operations: an intelligence organization subordinate to the defense establishment and the Revolutionary Guards’ cyber command. “They coordinate to some extent, but they also compete with one another, and each has its own offensive capabilities.”
A dry river in Iran, November 2025
(Photo: Majid Asgaripour/WANA (West Asia News Agency)/Reuters)
Pinko described Iran’s approach as part of a broader doctrine of attacking critical national infrastructure during conflict. “The Iranian strategy was learned from the Soviets,” he said. “NATO calls it hybrid warfare, China calls it contactless warfare and Iran calls it symmetrical warfare. In the end, it is all the same thing.”
Iran has attempted to strike critical infrastructure in Israel beyond water systems, including electricity grids, banks and government offices, he added. He also warned that Israel’s defensive framework remains incomplete despite the country’s reputation as a cyber power.
“Israel has a National Cyber Directorate that is still operating without a law,” Pinko said. “It is supposed to be a regulator, but it is not. There are excellent people and strong capabilities there, but without binding regulation, every government ministry does as it sees fit. That is the sad part of the story.”
Absolute protection is impossible, particularly when industrial control systems remain exposed to the internet or use weak passwords. “There will never be 100% protection,” Pinko said. “But defensive layers can be built with technological capabilities. It is a combination of several layers, including awareness and organizational culture.”
The objective, he said, is not to eliminate every possible intrusion, but to reduce the likelihood of a successful attack by shrinking what cybersecurity professionals call the attack surface. In a region where water scarcity already threatens economies, communities and political stability, even a limited cyberattack can cause damage far beyond the technical breach itself. The fear that taps could run dry, chlorine levels could be manipulated or desalination plants could stop working is itself part of the weapon.