New Delhi, Aug. 1 -- the programmable logic controllers governing two municipal water towers and fourteen sewer lift stations had been accessed remotely, their configurations altered, their control panels no longer responding the way operators expected. No water was contaminated, pressure held, and the city kept the taps running. But for a window of time that Plymouth officials declined to specify precisely, the logic governing the hardware that keeps an American city's water system functional was not under American control.

The Plymouth incident was one of more than thirty similar breaches recorded across Minnesota in a single week, part of a coordinated assault on municipal water infrastructure spanning at least seven states. The Feder...