Cyberwarfare Against The United States Is Edging From Spying Toward Sabotage

The Real Cyber Threat to Americans Isn’t A Blackout — It’s What Comes Before, Research Suggests

On July 27, a water pump station outside Atlanta stopped working. Pressure in the lines dropped, and customers were told to boil their water. Service was back within a few hours, and testing showed the water was safe. But the shutdown wasn’t a routine equipment failure. It came during a wave of cyberattacks on water systems across the country. Iran-linked hacking groups later claimed some of those attacks, and investigators reportedly suspected Iran, but the U.S. government had not publicly named who was responsible.

Moments like that raise a question most Americans likely aren’t thinking about: are foreign nations turning to cyberwarfare against the United States more often, and how exposed are the rest of us? Taken together, intelligence assessments, government advisories, industry threat data, and peer-reviewed research give a mixed but concerning answer.

Is Cyberwarfare Against the United States Increasing?

Evidence points to growing activity in several major state-linked campaigns, though no public count measures the total.

There is no single public count of state-backed hacking against the United States, so analysts rely on intelligence reports and on security companies that monitor their customers’ networks around the world.

The U.S. intelligence community’s 2025 Annual Threat Assessment called China “the most active and persistent cyber threat” to U.S. government, private-sector and infrastructure networks. The 2026 assessment, presented to Congress in March, said China, Russia, Iran, North Korea and ransomware groups will keep trying to break into American networks, both to collect intelligence and to create options for future disruption. It also estimated that North Korea probably stole about $2 billion in cryptocurrency in 2025, money that helps fund the regime and its weapons programs.

Industry data shows growth in some of the biggest campaigns. CrowdStrike tracks more than 280 named hacking groups. Across the networks it monitors worldwide, its 2026 Global Threat Report found a 38% rise in intrusions by China-linked groups in 2025, and attacks on logistics companies were up 85%. Incidents tied to North Korea rose 130% over the year before.

Microsoft’s 2025 Digital Defense Report found that nation-state activity grew in both volume and geographic reach. Of the customer impacts Microsoft recorded worldwide from January to June 2025, 24.8% were in the United States, the largest share of any country.

These companies only see their own customers, so their numbers aren’t a full count of every attack, and most aren’t U.S.-only measures.

Still, they line up with what U.S. officials have warned publicly.

What Types of Cyberwarfare Are Hitting America?

Mostly spying and theft, with a growing push toward positioning for sabotage.

For state-backed hackers, espionage is still the most common goal. A Chinese group known as “Salt Typhoon” has been breaking into telecommunications networks since at least 2019. In August 2025 the FBI said it had warned at least 600 organizations that the group was interested in their systems, with targets in about 80 countries, Nextgov reported. The hackers got into the “lawful intercept” systems some telecom companies use to handle wiretap requests.

Officials worry more about a second category. In a February 2024 joint advisory, CISA, the NSA and the FBI said they had high confidence that another Chinese group called “Volt Typhoon” was setting itself up inside communications, energy, transportation and water systems so it could disrupt them in a future crisis or military conflict. In some networks it had kept a foothold for at least five years. It stayed hidden mainly by using the victims’ own built-in admin tools rather than obvious malware.

The third category is actual disruption, and 2026 brought the clearest U.S. example so far. The FBI, CISA, NSA, EPA, Energy Department and U.S. Cyber Command issued a joint advisory on April 7, 2026, and updated it in July. It said Iranian-affiliated hackers had been tampering with internet-exposed industrial controllers at water systems, energy facilities and local governments since at least March. In some cases they changed what operators saw on their screens and switched off safety shutdown and alarm functions.

The agencies said the escalation was “likely in response to hostilities between Iran, and the United States and Israel.”

The broader wave of water attacks began in late July. More than 30 Minnesota water systems were hit, and news reports compiled by CSIS put the number of affected states at a dozen or more. CISA later said it saw activity targeting more than 100 internet-exposed water and wastewater systems that month. Two Iran-linked groups, CyberAv3ngers and one calling itself APT Iran, claimed responsibility for the Minnesota attacks.

As of August 18, though, the U.S. government had not publicly attributed the July campaign, even though federal agencies had already tied the earlier 2026 attacks on industrial controllers to Iranian-affiliated hackers. Iran-linked hackers had gone after U.S. water facilities before, though those earlier incidents involved one target or a few. The 2026 wave was far broader.

What Could Cyberwarfare Look Like Next?

Officials point to two concerns: faster, AI-assisted attacks and hidden footholds activated during a crisis.

The 2025 threat assessment warned that if Beijing believed a major conflict with Washington was imminent, it could consider aggressive cyber operations against U.S. infrastructure and military assets. Volt Typhoon’s long-term access is exactly the kind of foothold such an operation would use.

Artificial intelligence could speed things up. The 2026 assessment said AI will likely accelerate cyber threats, with both attackers and defenders using it to work faster. CrowdStrike counted an 89% jump in attacks by AI-enabled groups in 2025. One concrete example comes from Anthropic, which makes the AI system Claude. In a November 2025 report, the company said a Chinese state-sponsored group, which it identified with high confidence, manipulated its Claude Code tool into doing 80% to 90% of the hands-on work in a spying campaign. The campaign targeted about 30 organizations and succeeded against a handful. The AI also exaggerated its results and sometimes made up data, which Anthropic called “an obstacle to fully autonomous cyberattacks.”

How Vulnerable Are Americans to Foreign Hackers?

More exposed than most people assume, though the worst-case scenarios have not happened and basic defenses help.

Infrastructure is the weak spot experts mention most. CSIS notes that the United States has more than 150,000 water systems, many run by local governments that are short on staff and cybersecurity resources. The 2026 advisory found that attackers got in through controllers that could be reached from the open internet.

Health care shows how disruption can cost lives. University of Minnesota researchers published a 2022 study in JAMA Health Forum that counted 374 ransomware attacks on U.S. hospitals, clinics and other providers from 2016 to 2021. Those attacks exposed the health records of nearly 42 million patients. The number of attacks per year more than doubled, from 43 to 91, and about 44% of attacks disrupted patient care. In a follow-up published in 2026 in American Economic Journal: Economic Policy, three of the same researchers matched attacks to Medicare records. Among Medicare patients who were already in the hospital when an attack started, deaths in the hospital rose 34% to 38%.

Microsoft notes that most attacks organizations face come from profit-seeking criminals rather than governments. It still urges action against “safe haven” countries that ignore ransomware gangs, and U.S. intelligence lists those gangs alongside China, Russia, Iran and North Korea as threats.

There are also good reasons not to panic. Microsoft found that only 4% of the attacks its responders handled with a known motive were purely about spying. Data theft and extortion were much more common.

CSIS called the damage from the 2026 water attacks relatively minor, and the Georgia pump shutdown was the most serious case it found. A study in the Journal of Conflict Resolution compared 1,841 cyberattacks with 26,289 acts of violence in Ukraine, and ran a similar analysis with data from Syria. It found that the mostly low-level hacking had little or no effect on what happened on the battlefield. The authors wrote that their findings “should temper the popular tendency to overhype the transformative potential of cyber attacks.” They also cautioned that cyber coercion may simply not work yet, and their data come from before today’s AI tools.

Taken together, the evidence suggests foreign governments are probing, stealing from and quietly setting up inside American networks more than before. Large-scale sabotage, though, is still something they could do rather than something they regularly do. For individuals, the most effective protection is cheap: Microsoft reports that multifactor authentication can block more than 99% of identity-based attacks, and it recommends phishing-resistant versions, such as passkeys or physical security keys, over text-message codes.

The Georgia pump was running again within hours. Whether the next outage ends as quickly may depend less on what foreign hackers intend than on how many small utilities still leave their controls reachable from the open internet.