Two New Jersey water facilities were recently targeted in cyberattacks that affected computer systems used to monitor parts of their operations, according to state cybersecurity officials.

The facilities have not been publicly identified. New Jersey cybersecurity investigators say the incidents are part of a broader series of attacks that may have impacted as many as a dozen water facilities across the country.

Authorities say the attacks did not compromise the water supply itself. Instead, hackers targeted internet-connected industrial control systems used to remotely monitor and manage operations. An investigation by the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) found that security weaknesses in those systems temporarily prevented operators from monitoring or controlling them remotely.

Cybersecurity expert Scott Schober of Berkeley Varitronics Systems said internet-connected infrastructure can be especially vulnerable.

“Once it goes through the internet, it’s open to the world,” Schober said. “That’s part of the problem.”

Schober noted that many water utilities rely on older technology and software that may not be updated regularly.

"Water tends to have legacy software systems, computers and hardware that’s not upgraded that much,” he said. “They have a lot of remote-control capabilities that have been added.”

Investigators have not determined who was responsible for the attacks. Some analysts have suggested Iran may be involved, but officials say more forensic analysis is needed before attributing blame.

“The first thing that comes to mind is the fact that the U.S. is at war with them. Red flags go up, likely the culprit,” Schober said. “But many hackers are knowledgeable. They can actually look at the strain of the code and mimic someone else.”

In a statement, the New Jersey Office of Homeland Security and Preparedness said, “Both systems have since been secured with strengthened access controls. The NJCCIC continues working with these utilities and with water systems statewide to reduce the risk of similar incidents going forward."

Officials said utility staff at both facilities switched to manual operations during the incidents, preventing any disruption to water service. The NJCCIC is continuing its investigation alongside the FBI and other federal partners. Authorities say efforts are also underway to strengthen cybersecurity protections at water systems across the state.