Water networks, factories, energy: the warnings keep piling up. Is anyone at the controls?

Foreword: the problem is no longer merely knowing, but acting

On 21 August 2026, Le Figaro highlighted an FBI warning about attacks on water networks and the risk of industrial failures in France. Read in isolation, the headline can look like a new threat imported from the United States. Read chronologically, it is the latest episode in a much longer story: France has had a legal framework for vital operators since 2013, water-sector security rules since 2016, ANSSI evidence of incidents and exposed industrial equipment, European resilience obligations, and repeated warnings about uneven maturity. Meanwhile, US agencies reported attacks on water PLCs with loss of pressure and flooding in July 2026, followed in August by an inter-agency alert on active targeting of Siemens S7 systems, including AI-assisted exploitation scripts. [1][2][3][4][9][10][11]

The political dimension became harder to dismiss on 19 August 2026, when Prime Minister Sébastien Lecornu publicly stated that few ministries were at the required cybersecurity level and asked ANSSI to create a new operational cyber unit. The same day, US agencies issued their Siemens S7 warning. This coincidence does not prove that the French government had suffered an S7 campaign; it shows that industrial threats were accelerating at the very moment the head of government acknowledged insufficient cyber maturity inside the State. [11][13]

A one-page chronology

I. Thirteen years of alerts and rules: the scenario was not invisible

2013 and 2016: critical infrastructure and water were already treated as cyber-security issues

The 18 December 2013 Military Programming Law created specific obligations for protecting vital infrastructure from cyber threats and placed national coordination of information-system security under the Prime Minister. Three years later, a dedicated order established security and incident-reporting rules for information systems of vital importance in the water sector. These measures do not mean every future vulnerability was known; they mean that the risk of cyber compromise of essential services has been officially recognised for more than a decade. [1][2]

Water is especially difficult because responsibility is fragmented across municipalities, inter-municipal bodies, syndicates, public utilities, private operators, integrators and contractors. A national operator and a small local utility do not have the same engineers, budgets or capacity to replace industrial equipment that may be decades old.

2021–2024: French incidents were already real, not hypothetical

CERT-FR reported in November 2024 that 46 water-sector entities had been affected by IT events handled by ANSSI between January 2021 and August 2024. ANSSI described old installations, geographically dispersed sites, sometimes weak security budgets, highly uneven maturity and industrial interfaces reachable from the Internet. Remote management increases the attack surface; protocols designed historically for availability and simplicity may lack the authentication and encryption expected on today’s hostile Internet. [3]

Industrial control is different from ordinary office IT. A compromised interface can operate a pump, valve, chemical dose, tank level, pressure setpoint or motor. At that point, a cyber incident can become a physical event.

2024–2026: European deadlines, French delays and repeated warnings

NIS2 and the Critical Entities Resilience Directive were designed to broaden and harmonise cyber-security and continuity obligations. The transposition deadline was 17 October 2024. France did not complete transposition on time; infringement procedures eventually led to referrals to the Court of Justice in 2026. France was not the only Member State involved, but the proceedings objectively document delay on legislation directly connected to cyber-security and resilience. [4][9]

The Senate adopted the French resilience and cyber-security bill at first reading on 12 March 2025. In June 2025, the Cour des comptes called for stronger inter-ministerial steering, better programming of resources and greater involvement of public-sector leadership. This matters because an institution can have excellent engineers and analysts while remaining weak at governance: who has the authority, budget and timetable to make a vulnerability disappear? [5][6]

Cybermalveillance.gouv.fr also documented highly uneven preparation in smaller local authorities. That study does not prove that their water systems are insecure; it does document a structural difficulty in territorial cyber maturity. [7]

January 2026: ANSSI was still seeing compromises in water and energy

CERT-FR reported multiple French compromises in water and energy and again described Internet-accessible equipment, weak authentication, default credentials and exposed industrial protocols. It went as far as recommending local operation and disconnection from the Internet when minimum security measures could not be implemented. It also reported a case that stopped a wind farm for several hours. [8]

July and August 2026: cyber attacks produced physical effects in US water systems

On 30 July, the FBI and EPA warned of attacks against Internet-facing Rockwell Automation / Allen-Bradley MicroLogix PLCs in water and wastewater facilities. Attackers changed addresses and passwords and caused loss of visibility or control. The FBI reported loss of pressure and flooding; depending on circumstances, pressure loss can also create water-quality risks. The point is decisive: cyber compromise can alter the physical conditions of an essential service. [10]

On 19 August, NSA, CISA, FBI, DOE and EPA issued a joint warning about active targeting of Siemens S7 PLCs. The advisory described actors using Internet-scanning services and AI-generated or AI-assisted exploitation scripts, sometimes disguised as legitimate monitoring tools. Water, energy, manufacturing, chemicals and food were among the affected sectors. Siemens then provided an essential counterpoint: it said it had not observed a surge in attacks or an unknown vulnerability, and stressed known configuration weaknesses. That nuance should not be lost; the issue is not a secret universal Siemens flaw, but the persistence of exposure, obsolete configurations and weak hardening. [11][12]

II. When a foreign service warns: four instructive precedents

Cyber-security is not the only field in which receiving information and acting on it are different operations. The Thalys case, the 2015 terrorist attacks, intelligence before Russia’s 2022 invasion of Ukraine and the 2017 MacronLeaks episode illustrate four different failure or success modes: transmission, interpretation, prioritisation and prepared response.

Thalys and the 2015 terrorist attacks

Parliamentary work revisited the case of Ayoub El-Khazzani, who had been signalled by Spanish services before boarding the Amsterdam–Paris Thalys in August 2015. The sources do not show that French services had a simple operational opportunity to arrest him beforehand; they do show the difficulty of moving, harmonising and exploiting signals between European countries. [15]

“The 2015 attacks represent a global intelligence failure.” — Patrick Calvar, then head of the DGSI [14]

Calvar’s formulation matters because it came from the head of the service itself. It does not mean that individual analysts or police officers failed to work. It means that a complex system can fail despite surveillance, information and cooperation. Criticising the decision chain is not the same as attacking the professionals who produce the warnings.

Ukraine 2022: the information existed, but interpretation diverged

Before Russia’s invasion, the United States and United Kingdom adopted a much more alarmist reading of Russian force concentrations. French services had allied information but assessed Moscow’s intentions differently. After the invasion, Chief of Defence Staff Thierry Burkhard acknowledged publicly that the Americans had correctly anticipated the attack. [24]

“The Americans said the Russians were going to attack; they were right.” — General Thierry Burkhard, March 2022 [24]

This precedent is about interpretation rather than transmission. Intelligence is not merely data; it must become an assessment and then a decision. Accurate information can lose operational value if filtered through an overly reassuring or rigid analytical frame.

MacronLeaks 2017: a counter-example in which preparation worked

For intellectual balance, the cases in which the chain works matter too. Before the 2017 French presidential election, warnings about influence operations and intrusion attempts led to stronger preparation. When emails and documents were released shortly before the second round, measures taken by authorities, media and the campaign helped limit the operation’s effect. [17]

That counter-example shows that international cooperation and intelligence are not inherently ineffective. They produce value when an alert is understood, responsibility is clear and measures are prepared before the incident.

III. What is intelligence for if the final kilometre of decision-making fails?

The DGSI defines intelligence gathering, centralisation and exploitation in support of national security and fundamental national interests as core missions. The national intelligence coordination structure exists to ensure coherence and inform the President. In cyber-security, ANSSI, CERT-FR, intelligence services, ministries, judicial authorities, operators, sector CSIRTs, European partners and allies already form a substantial ecosystem. [18][19][25][26]

The final kilometre of national security

The weak point can lie between detection and correction. An expert identifies an exposed interface; a note is escalated; a recommendation is published. Then somebody must decide who pays, who orders the shutdown, who replaces a twenty-year-old PLC, who checks the contractor, who verifies implementation and who accepts a temporary service interruption to prevent something worse. That is the final kilometre.

In water, fragmentation makes the problem particularly visible. The State can warn, while the physical correction may depend on a municipality, public utility, private concession holder, industrial contractor or locally voted budget.

Why invest so much in warning systems if the decision cycle remains slower than the attacker?

France employs analysts, engineers, police officers, soldiers, diplomats, magistrates and operational centres to detect threats early. That investment has value only if the information advantage buys time. Attackers do not need a budget vote, an inter-ministerial circular or a validation meeting before testing an exposed configuration. AI further reduces the cost of reconnaissance, script generation and adaptation. The problem is not only that attackers become more capable; their decision cycle can become far shorter than the defender’s. [11]

If information arrives quickly but action arrives slowly, a State can become paradoxically better informed than before while still unable to reduce risk fast enough. The problem is then not absence of intelligence but organisation of political will.

IV. Can one speak of “political incompetence”?

The expression is severe. Used as a blanket personal accusation, it would be intellectually lazy. Used as a political judgment about measurable governance results, it can be debated. Four objective elements make that debate legitimate: the Prime Minister’s own admission of insufficient ministry cyber maturity; the Cour des comptes’ criticism of steering and resources; European infringement proceedings for delayed transposition; and ANSSI’s continuing need to repeat elementary hardening rules in 2026. [6][8][13]

None of those facts alone proves that “the State is incompetent”. Together they support a narrower claim: persistent governance, homogenisation and implementation failures can reasonably be described as political incompetence when decision-makers have warning, authority and time but do not obtain verified correction.

Do not blame the wrong people

This criticism should not be aimed indiscriminately at ANSSI engineers, DGSI personnel, police or military staff. The cited documents show that many of them are precisely the people raising alarms. Political responsibility begins where expertise fails to become prioritisation, resources, binding action and verification. [3][6][8][14]

V. Water, energy and industry directly concern the fundamental interests of the Nation

Article 410-1 of the French Criminal Code defines the fundamental interests of the Nation broadly, including security, protection of the population and essential elements of scientific and economic potential. Water concerns population safety; energy conditions economic continuity; industrial processes contribute to national productive capacity. [20]

A legal distinction is essential: saying that poor policy may expose the fundamental interests of the Nation is not the same as alleging that a public official has committed the criminal offence of attacking those interests. The dossier concerns political and administrative responsibility, not an accusation of crime.

VI. Questions the State should answer publicly

• How many industrial controllers used in French water and wastewater networks are still directly or indirectly reachable from the Internet?
• How many are protected only by mechanisms now regarded as insufficient or by default credentials?
• What national inventory exists for critical industrial controllers and how current is it?
• After the 30 July US warning, what checks were requested from French water operators?
• After the 19 August Siemens S7 alert, what instructions were transmitted to French operators, and how quickly?
• Were non-public technical indicators exchanged between US and French services?
• Who verifies implementation of ANSSI recommendations in small organisations outside the historical OIV perimeter?
• Who finances replacement of obsolete industrial controllers when small local authorities cannot?
• How many operators can switch safely to manual or degraded mode if supervision is compromised?
• Who has final responsibility for proving that an alert became a correction and that the correction was tested?

A generic statement that “services are mobilised” is not an answer. The result is measured in eliminated exposure, intrusion-detection capability, service continuity and time to return to a safe state.

VII. Is anyone at the controls?

It would be false to write that the French State does nothing. France has a national cyber-security agency, powerful intelligence services, European and international cooperation, legal obligations and professionals working every day to reduce risk. The troubling fact is that this impressive architecture coexists with weaknesses its own institutions have described for years.

What worries is not the absence of reports, but their accumulation; not the absence of warnings, but their repetition; not the absence of cooperation, but uncertainty over how quickly information becomes verified field action. In a modern State, intelligence is supposed to buy time. If a known vulnerability must be exploited before the previously obvious arbitration is finally made, much of that intelligence advantage has been wasted.