At least seven U.S. states have reported cyberattacks on water supply facilities since July 2026, in which attackers gained remote access to networked systems.