Illinois water cyberattack reporting remains split across general safety rules and federal guidance. A pending bill would require cybersecurity programs and incident procedures as utilities confront threats to connected control systems across the state.
Illinois reporting rules leave a cyber gap
Illinois water systems operate under general emergency-notification rules, but the state still lacks a dedicated law requiring every utility to follow one uniform cyberattack reporting process. State regulations require immediate notice to the Illinois Environmental Protection Agency whenever a water supply’s safety is endangered. Separate Illinois EPA guidance tells hacked systems to contact CISA, the Illinois Emergency Management Agency and the FBI.
Federal warning targets water infrastructure
On July 22, 2026, CISA and federal partners warned that Iran’s Islamic Revolutionary Guard Corps-affiliated actors were exploiting internet-connected programmable logic controllers across multiple sectors, including U.S. water and wastewater facilities. Compromised controls could disrupt access to operating systems or alter treatment processes.
Illinois EPA reported 1,868 active community water systems serving more than 12.1 million people in 2024. Chicago draws its drinking water from Lake Michigan through two treatment plants, showing the scale of infrastructure that depends on reliable controls and monitoring.
Utilities face detection challenges
Cyber intrusions may not immediately cause a visible shutdown. Attackers can compromise data, deny operators access or change system settings, while smaller utilities may have limited cybersecurity staff and monitoring tools. Delayed detection can slow coordination with regulators and investigators and may create health risks if treatment or distribution is affected.
HB3576 would set cybersecurity standards
House Bill 3576 would require water purveyors to establish cybersecurity programs, create incident-reporting processes and submit compliance reports. The measure was re-referred to the Illinois House Rules Committee on March 27, 2026, and had not become law as of August 5, 2026.
Until lawmakers act, utilities remain subject to existing safety-notification rules and federal cyber guidance. Any new mandate’s effectiveness will depend on clear reporting thresholds, funding, trained staff and technical support that help systems detect and recover from attacks.
