Infrastructure Threats to Our Drinking Water: What the Government Isn’t Telling You

For most people, you get thirsty and you turn on the tap without a second thought. Water comes out, it looks clear, so it must be safe. That assumption is getting more dangerous by the year.

The truth is that America’s public water supply faces a three-front crisis: aging infrastructure that was never designed to handle 21st-century contaminants, an explosion of chemical pollution that most treatment plants can’t touch, and an accelerating wave of cyberattacks from nation-state hackers actively probing our water systems right now. Any one of those problems would be serious. All three at once is a genuine public health emergency — and Washington has been slow to admit it.

The Infrastructure Is Crumbling — Quietly

Engineers who grade America’s infrastructure don’t sugarcoat things. The American Society of Civil Engineers releases a report card every four years, and in their 2025 edition, U.S. drinking water earned a C-. Wastewater got a D+. Stormwater tied for the lowest grade in the entire report at a flat D. Those grades are unchanged from 2021, meaning billions in federal investment under the Infrastructure Investment and Jobs Act haven’t been enough to move the needle.

To understand why that matters, you need to know what a “C-” actually means in physical terms. Water mains break approximately 240,000 times per year across the country. Much of our distribution network runs on pre-World War I-era pipes — cast iron, unlined, corroding from the inside out. These systems were engineered over a century ago to filter out particles, parasites, and bacteria. They were never designed to deal with pesticides, industrial chemicals, pharmaceuticals, or synthetic compounds that didn’t exist when the pipes were laid.

The price tag to fix it is staggering. The EPA’s own 2023 national needs assessment puts the 20-year cost of getting U.S. water infrastructure to a state of good repair at $625 billion — a figure that’s 30% higher than the EPA’s previous estimate just five years earlier. Meanwhile, ASCE calculated the investment gap at $309 billion as of 2024, on pace to balloon to $620 billion by 2043. Only 20% of water utilities say they can fully cover the cost of their drinking water services even while customer bills keep rising.

What’s Actually in Your Water

The chemicals are the part of this story that gets downplayed the most, because the full list reads like something from a chemical plant incident report — not your kitchen faucet.

PFAS: The Forever Chemical Epidemic

Per- and polyfluoroalkyl substances — PFAS — have become the defining water contamination crisis of our generation. As of June 2025, new EPA data shows that approximately 165 million Americans are drinking water contaminated by these toxic compounds. That’s roughly half the country. The Environmental Working Group’s acting chief science officer called it “impossible to ignore,” noting that PFAS is now detectable in nearly everyone and nearly everywhere.

PFAS are called “forever chemicals” because they don’t break down in the environment or in your body. Exposure has been linked to cancer, immune system damage, reproductive harm, and other serious health conditions even at extremely low levels. The EPA identified over 9,700 contaminated sites across all 50 states as of mid-2025.

Here’s where it gets worse: In 2024, the EPA finalized the first-ever national drinking water standards for six PFAS compounds — a landmark public health victory. Then in May 2025, the EPA reversed course, announcing plans to roll back limits for four of those six chemicals, leaving them effectively unregulated. The compliance deadline for the remaining standards was pushed from 2029 to 2031. The estimated annual cost to install treatment systems capable of removing PFAS runs to more than $3.8 billion — a burden that would fall largely on water utilities that are already underfunded.

Lead: Still Everywhere, Still Dangerous

There is no safe level of lead exposure. That’s not an environmental activist talking point — that’s the official position of the EPA, the CDC, and every major health authority on the planet.

The United States still has an estimated 4 to 9 million lead service lines delivering water to homes, schools, and businesses. The number varies depending on who you ask and how you count — the EPA revised its estimate from 9.2 million down to 4 million in late 2025, a dramatic revision that critics at NRDC and Earthjustice immediately questioned, noting that over 24 million service lines were listed as “unknown material” in utility inventories. When utilities can’t tell you what their pipes are made of, that’s not reassuring.

The Bipartisan Infrastructure Law dedicated $15 billion specifically to replace lead service lines, and in 2024 the EPA set a 10-year deadline to eliminate them all. But nearly 22 million people across all 50 states are still drinking through lead pipes today. Cities like Baltimore, Buffalo, Chicago, Cleveland, Milwaukee, Newark, Pittsburgh, and Washington D.C. have all documented dangerously elevated lead levels in their water. The CDC estimates that approximately 400,000 American children currently have blood lead levels above the safety reference threshold.

Pharmaceuticals, Pesticides, and Hormone Disruptors

The chemical contamination doesn’t stop at PFAS and lead. Researchers who analyze public water supplies regularly find prescription drugs, agricultural runoff chemicals, and endocrine-disrupting compounds flowing straight through conventional treatment systems and out of your tap.

Hormone-disrupting chemicals — also called endocrine disruptors — have been found in municipal water supplies throughout the country. Researchers have linked these compounds to declining sperm counts, infertility, developmental delays in children, and metabolic disorders. Dichlorophenols, the chemicals used in commercial weed killers, have been detected in urine samples across large study populations — suggesting that what enters our water eventually enters us. Pharmaceutical compounds including antibiotics, anticonvulsants, mood-altering drugs, and sex hormones have turned up in water systems nationwide, the byproduct of medications excreted by millions of people and insufficiently removed during wastewater treatment.

Conventional water treatment — the kind most American cities use — was not built to handle any of this.

The Cyberattack Problem and How One Person can Wreak Havoc

If deteriorating pipes and unregulated chemicals aren’t enough, consider that hackers are now actively targeting water treatment facilities across the United States. Not as a hypothetical. Right now.

The EPA, CISA, and FBI have issued multiple joint advisories warning that nation-state actors from Russia, China, and Iran have penetrated water and wastewater systems — and that some have already embedded the capability to disable them when needed. That’s not speculation from a prepper forum. That comes directly from the U.S. government’s own enforcement alerts.

Not needed for this task. Here’s the fully rewritten section, clean and ready to drop in:

The Threat of Cyberattacks & Deliberate Sabotage

Most people assume that because water comes out of the tap, someone competent is watching over the system producing it. That assumption is getting harder to defend.

The vulnerability of America’s water infrastructure to deliberate attack is no longer theoretical — it’s documented, ongoing, and confirmed at the highest levels of federal law enforcement. In May 2024, the EPA issued a formal enforcement alert stating that cyberattacks against water systems are “increasing in frequency and severity across the country,” and that hackers have already demonstrated the ability to manipulate treatment processes, damage pumps and valves, and alter chemical levels in drinking water to dangerous amounts.

These aren’t fringe incidents. The U.S. government’s own enforcement alert put it plainly: cyberattacks against water systems are increasing in frequency and severity. Hackers can manipulate treatment processes, damage pumps and valves, and — most alarmingly — alter the chemical levels in your drinking water to dangerous amounts.

What’s making this worse is the same thing that’s made every critical infrastructure sector more vulnerable: these systems are going online. Water facilities that were previously air-gapped and isolated are being connected to the internet as part of routine infrastructure upgrades. Security researchers have noted that as connectivity increases, so does the attack surface — and most small water utilities don’t have the budget or personnel to fight a nation-state cyberattack.

The attackers aren’t random criminals. They’re nation-states. Russia, Iran, and China have all been confirmed as active threats to U.S. water infrastructure — each with different methods and goals.

Here’s what has actually happened, with sources:

November 2023 — Iranian government hackers breach Pennsylvania water authority. The Municipal Water Authority of Aliquippa, Pennsylvania was breached by a group called CyberAv3ngers, confirmed by a joint advisory from the FBI, CISA, NSA, and Israeli authorities to be affiliated with Iran’s Islamic Revolutionary Guard Corps. The hackers targeted an Israeli-made industrial controller, took it offline, and displayed anti-Israel messages on the screen. The utility spent over $10,000 in equipment and labor just to recover. At least a half-dozen other U.S. water facilities were impacted in the same campaign.

January 2024 — Russian-linked hackers attack Texas water systems, cause tank overflow. Multiple water and wastewater facilities in Texas were hit by a group calling itself CyberArmyofRussia_Reborn, which posted videos on Telegram showing themselves manipulating SCADA controls at U.S. water utilities. In Muleshoe, Texas, a water storage tank overflowed. Cybersecurity firm Mandiant identified links between the group and Sandworm, a unit of Russian military intelligence — the same organization behind the NotPetya cyberattack that caused billions in damage to global infrastructure in 2017. Federal investigators found the hacked facilities were protected by outdated equipment and weak passwords, making them easy targets.

April 2024 — Wastewater plant in Indiana breached, operations disrupted. The Cyber Army of Russia posted video claiming to show their access to the Tipton Wastewater Treatment Plant in Indiana. Staff caught irregular activity through standard monitoring and switched to manual control while the breach was investigated. The FBI opened an investigation.

September 2024 — Kansas water plant forced to manual operations. The water treatment facility in Arkansas City, Kansas experienced a cybersecurity incident that forced a temporary switch to manual operations while the breach was investigated. Drinking water was not affected, but the incident illustrated exactly the kind of operational disruption federal agencies had been warning about.

October 2024 — America’s largest water utility breached. American Water, which serves 14 million people across 14 states and 18 military installations, was hit by a cyberattack that took down customer systems for over a week, forced a shutdown of billing operations, and prompted notification of federal law enforcement. Moody’s called it credit negative. No attacker was publicly named.

March 2026 — Ransomware hits North Dakota water plant, FBI investigates. The water treatment facility in Minot, North Dakota — which serves roughly 80,000 people — had its SCADA system hit by ransomware on March 14. Staff had to switch to manual operations for 16 hours while a replacement server was located. The FBI opened an investigation, and the city paid nothing. The water remained safe — this time.

The Chinese threat is in a different category entirely. While Russian and Iranian groups have been causing visible disruptions, China’s Volt Typhoon hackers have been playing a longer game. CISA, the NSA, and the FBI confirmed in a February 2024 joint advisory that Volt Typhoon had maintained persistent access inside U.S. critical infrastructure — including water systems — for at least five years without being detected. They aren’t breaking things. They’re positioning. FBI Director Christopher Wray put it plainly when he testified before Congress in January 2024: “China’s hackers are positioning on American infrastructure in preparation to wreak havoc and cause real-world harm to American citizens and communities, if or when China decides the time has come to strike.”

The common thread in every one of these incidents is exactly what federal investigators found when they examined the breached Texas facilities: outdated equipment connected to the internet, protected by default or weak passwords. The EPA’s own enforcement review found that more than 70% of inspected water systems do not fully comply with federal cybersecurity requirements. These systems were never designed to be internet-connected. Vendors pushed connectivity upgrades for remote monitoring and management — and opened a door that adversaries have been walking through ever since.

The water coming out of your tap passes through systems that Russia, Iran, and China have already breached. That’s not a warning about what might happen. That’s what already has.

The Regulatory Retreat Making Things Worse

At exactly the moment when public pressure was finally producing meaningful action on water safety, the regulatory environment has started moving in the wrong direction.

The EPA’s rollback of four PFAS drinking water limits in 2025 was one major reversal. The Trump administration’s blocking of hundreds of millions in federal funding for lead pipe replacement was another — creating direct complications for states trying to meet the 10-year replacement deadline. Proposals in Congress to repeal the Lead and Copper Rule Improvements narrowly failed this year, but the fight isn’t over.

In the meantime, only 28% of water utilities have fully implemented risk and resilience assessments that federal law required to be in place by 2021. The median age of the water sector workforce is 48 — and the EPA found that roughly a third of the nation’s water workers will hit retirement age within the decade, with only 10% of current workers under 24. This isn’t just an infrastructure problem. It’s also a people problem.

What You Can Actually Do About It

The official response to contaminated public water tends to consist of announcements, extended deadlines, and funding allocations that take years to reach the pipes under your street. That’s not a plan you can drink.

Get your water tested. This is the non-negotiable starting point. Municipal consumer confidence reports are publicly available and required annually — read yours. But those reports measure compliance against what’s currently regulated, which means unregulated PFAS compounds, pharmaceutical residues, and other emerging contaminants often don’t show up. Independent testing through a state-certified lab fills that gap. If your home was built before 1986, test specifically for lead.

Filter at the point of use. Not all filters are created equal and this distinction matters enormously. Standard pitcher-style activated carbon filters (like most Brita units) do NOT remove PFAS, lead, or pharmaceuticals effectively. For PFAS and heavy metals, you need a reverse osmosis system or a filter certified under NSF/ANSI Standard 58 for RO or Standard 53 for reduction of specific contaminants. NSF certification is the thing to look for on the label — it’s third-party verified performance, not marketing copy.

Store water independently. Cyberattack or contamination event doesn’t give you a warning window. A minimum 72-hour emergency water supply for every person in your household is the floor, not the goal. Two weeks is more realistic preparation for a serious infrastructure disruption. Use food-grade containers, store them away from heat and direct sunlight, and rotate your supply every 6-12 months.

Know how to treat water yourself. Even treated municipal water can become contaminated post-treatment — through pipe breaks, pressure drops, or deliberate sabotage. Boiling kills pathogens but doesn’t remove chemical contaminants. Chlorine dioxide tablets are effective against bacteria, viruses, and Cryptosporidium where chemical contamination isn’t the issue. For chemical contamination events, the only field-practical options are distillation or RO — neither is fast, but knowing how they work before you need them is the point.

Pay attention to boil-water advisories. They get issued more often than most people realize, and the lag between a contamination event and a public advisory can be significant. Local utilities and municipal emergency notification systems are worth signing up for.

The Threat Is Real — and It’s Compound

The original infrastructure post on this site was written in 2013. The problems it described were already serious then. In the years since, the contamination list has grown longer, the funding gaps have widened, nation-state hackers have gone from theoretical threats to confirmed intruders, and the regulatory environment that was finally starting to respond has partially reversed course.

Here’s the hard number to hold onto: the EPA says it would take $625 billion over 20 years to get America’s drinking water infrastructure to a state of good repair. The current annual investment gap is measured in the hundreds of billions. We’re not behind on this problem. We’re decades behind.

The water that comes out of your tap right now may be fine. Or it may contain lead, PFAS, pharmaceutical compounds, agricultural chemicals, or disinfection byproducts — and the system that’s supposed to protect you may not even know. That’s not paranoia. That’s what the EPA, the GAO, the ASCE, and every major public health institution is telling anyone willing to read the actual reports.

Stop outsourcing your water security to a system that’s already told you it’s struggling.

Test your water. Filter it at the point of use. Store a supply. And treat public water reports the same way you’d treat any other piece of government communications about critical infrastructure: verify, don’t assume.

Preparedness: Your Defense Against Water Threats

Governments move at a snail’s pace on infrastructure fixes, so the responsibility falls squarely on us—the individuals and families who refuse to be caught off guard. When the grid fails, conflicts spill over, or sabotage hits close to home, your access to clean water could vanish overnight. The key? Build layers of redundancy now: store what you can, purify what you find, secure your setup, and know where to turn next.

• Water Storage: FEMA and CDC still hammer home the baseline: at least one gallon per person per day for drinking and sanitation—aim for a two-week minimum (or more if space allows; some guides suggest bumping to 1.5 gallons in hot climates or high activity). Use food-grade containers, treat with bleach if needed for long-term storage, and rotate your stock every 6-12 months to keep it fresh. Fill bathtubs, sinks, and pots immediately if a crisis hits—your hot water heater alone can hold 40-50 gallons of usable emergency water (drain it via the bottom valve with a hose).
• Filtration and Purification: Don’t rely on boiling alone—it kills bacteria and parasites but leaves chemicals, heavy metals, and “forever chemicals” like PFAS behind. Invest in robust gravity-fed systems that tackle biologics, chemicals, and more. Berkey-style filters remain popular for off-grid use, but with recent regulatory scrutiny and much better alternatives, check out systems like Boroux Foundation, Alexapure Pro,or ProOne. Combine with UV purifiers for extra biological kill power, or distillation setups for the toughest contaminants. Portable filters like Katadyn Pocket are great for bug-out bags.
• Alternative Sources: Diversify beyond the tap. Set up rainwater catchment with barrels or tanks—simple gutters and food-grade containers can harvest hundreds of gallons during storms. If you’re in a position to drill a shallow well, do it. Coastal folks: look into portable desalination kits (hand-pumped or compact units like QuenchSea or emergency marine desalinator packs) for turning seawater usable in a pinch. Scout and map local natural sources—ponds, streams, rivers—note distances, risks, and access. In urban areas, carry a multi-tool and water spigot key to discreetly access commercial faucets (handles often removed to deter misuse—only for true emergencies, and be smart about it). For more on urban resupply tactics, including plotting routes, finding hidden sources, and escape planning, check out my older piece: Urban Resources: Finding Food & Water During a Long-term Disaster.
• Home Security: Water storage and systems are tempting targets—secure tanks, pipes, and access points against tampering or theft. For off-grid setups, build in redundancies: multiple filters, backup storage, solar-powered pumps if possible. Fortify your property with basic perimeter measures and early-warning tools.
• Prepper Communities and Monitoring: Prep isn’t solo—link up with local groups, neighbors, or mutual aid networks for shared resources and intel. Download the FEMA App for real-time weather alerts, emergency tips, shelter locations, and disaster updates—it pulls National Weather Service data and can notify you of water-related threats..

Updated June 2026. Original article published May 2013.