Concentric is monitoring escalating attacks on commercial shipping in the Strait of Hormuz and the Bab el-Mandeb, where strikes on UAE-linked tankers and the first Red Sea shipping fatalities in over a year have held Brent crude near $90 a barrel and left no low-risk maritime routing for Gulf trade. We are also tracking a widening campaign of suspected Iran-linked cyberattacks against U.S. water and wastewater utilities, now reported in at least 12 states, which demonstrates the exposure of internet-facing operational technology at critical infrastructure sites and industrial environments. Finally, we are assessing the operational and travel impact of Europe’s fifth heatwave of the summer, as wildfires along the Mediterranean coast and into the Balkans force mass evacuations, close major transport routes, and drive extreme fire danger across central and eastern Europe into late August.
Attacks at Both Gulf Chokepoints Leave No Low-Risk Maritime Route for Regional Trade
Maritime risk around the Arabian Peninsula increased further this week as commercial vessels came under attack at both of the region’s critical chokepoints. The United Arab Emirates condemned Iran for a drone attack on two vessels affiliated with the Abu Dhabi National Oil Company (ADNOC) as they transited the Strait of Hormuz on the evening of August 13, stating that authorities brought the situation under control. Two days earlier, Houthi forces killed at least six crew members in a missile strike on the Egyptian-owned, Tanzania-flagged Tihamah in the Bab el-Mandeb, the first shipping fatalities attributed to the group since the U.S.-Israel war on Iran began. U.S. Central Command separately disabled a Panama-flagged cargo vessel attempting to break the U.S. naval blockade of Iranian ports. Transit volumes remain severely constrained. The United Kingdom Maritime Trade Operations (UKMTO) recorded only 151 vessel movements through the Strait of Hormuz in the seven days to August 14, against roughly 130 transits per day before the conflict, and has logged 56 reports of damage to vessels in and around the strait since late February. The southern Omani corridor, promoted as a temporary alternative routing, accounts for 16 of the 18 projectile strikes reported since July 6. Brent crude for October delivery traded close to $90 a barrel on August 12, approximately 24 percent above pre-war levels, and U.S. energy prices were up 14.7 percent year-on-year in the July Consumer Price Index. With Hormuz effectively closed, Gulf exporters have shifted volumes to Saudi Arabia’s Red Sea terminals, but Houthi attacks on Saudi-linked shipping now reach that route too. Concentric assesses that this leaves no low-risk approach to Gulf trade and that disruption should be treated as a sustained condition rather than a temporary one. Talks between Iran and Oman continue, but Tehran maintains that the strait will not reopen until Washington lifts its naval blockade and meets further conditions, and we assess a near-term breakthrough is unlikely.
We advise businesses with Gulf exposure to review supply chain routing, inventory buffers, and energy cost assumptions against a prolonged disruption scenario, and to confirm duty of care arrangements for seafarers and for personnel traveling to or resident in Gulf states, where the risk of spillover from strikes and air defense activity persists.
Suspected Iran-Linked Cyberattacks on U.S. Water Utilities Expand to at Least 12 States
A wave of cyberattacks against U.S. water and wastewater utilities has now been reported in at least 12 states, after New Jersey and Alabama became the latest to confirm incidents. In New Jersey, the City of Cape May Sewer Department and the Borough of Woodbine Water Department reported intrusions within minutes of each other in the early hours of July 27, with both systems affected for approximately 12 hours. Minnesota was the first state to confirm the activity, with more than 30 community water systems impacted, followed by Michigan, South Dakota, Arkansas, and Georgia, where the Clayton County Water Authority, serving around 300,000 customers in the Atlanta area, recorded a drop in water pressure and issued a boil water advisory before restoring service within hours. The intrusions have targeted internet-exposed operational technology, including human-machine interfaces and programmable logic controllers used to regulate pumps, valves, and water pressure. In several cases operators lost remote monitoring and control and reverted to manual operation. The U.S. government has not formally attributed the campaign, although CISA warned in April, and again shortly before the first Minnesota incidents, that Iranian actors were targeting internet-connected devices in the water and energy sectors. The FBI has stated that water operations were degraded at some affected utilities. Officials report that drinking water safety has not been compromised. Concentric assesses that the limited service impact to date understates the significance of this activity, which demonstrates repeatable access to industrial control systems through well-documented weaknesses: internet-facing interfaces, default or shared credentials, and limited segmentation between IT and OT networks. These conditions are not unique to the water sector and are common across manufacturing, energy, food and beverage production, and building management systems. We further assess that the campaign is likely to continue while the conflict with Iran remains unresolved, and that municipal and mid-sized operators with constrained security resources represent the most probable targets.
We advise clients to inventory and, where possible, remove internet-facing OT assets, enforce credential hygiene and multi-factor authentication on all remote access, verify IT/OT segmentation, confirm that manual fallback procedures are documented and exercised, and extend these checks to third-party vendors holding remote access to industrial systems.
Europe’s Fifth Heatwave Drives Wildfire Disruption Across the Mediterranean and Balkans
Wildfire activity intensified across southern and central Europe this week as the continent experienced its fifth heatwave of the summer. A fire swept into the Croatian coastal town of Omiš, around 25 kilometers south of Split, overnight on August 13, burning more than 1,000 hectares, engulfing houses, and forcing the evacuation of around 2,000 residents and visitors. Police recovered a body from a burned area in Lokva Rogoznica on August 14, and hospitals in Split admitted 40 people, including German and Polish tourists, of whom 10 required intensive care. Croatia’s chief fire commander described the blaze as one of the worst in the country’s history. A section of the main Dalmatian coastal highway was closed, disrupting road links between Split and Dubrovnik at the peak of the tourist season. In northern Greece, authorities evacuated holidaymakers from a beach by fishing boat as a blaze advanced toward the shoreline, and Météo-France placed four departments under its highest wildfire alert on August 14. More than 2,000 people were evacuated from the village of Gey in western Germany after a fire near the Belgian border reached the settlement. The EU’s European Forest Fire Information System (EFFIS) recorded 567,097 hectares burned across Europe as of August 12, below the same point in 2025, the worst year on record, but more than double the 2006–2025 average of 243,189 hectares. Its fire danger forecast for August 13 to 19 indicates very extreme conditions across a broad band of central and eastern Europe, extending from Germany and the Alpine region through Poland and into the Balkans. Concentric assesses that the principal risk to clients is operational and travel disruption rather than direct physical threat, but that this disruption is significant and is occurring at the peak of the European holiday season. Road and rail closures, short-notice evacuations of coastal resorts, degraded air quality, and strain on regional emergency services are likely to recur while conditions persist. Heat is also a measurable business cost: research into the United Kingdom’s June heatwave estimated 24 million lost working hours and a $1.55 billion reduction in economic output.
We advise businesses and travelers in southern Europe and the Balkans to monitor national civil protection alerts and the EFFIS fire danger forecast, to build flexibility into travel itineraries through late August, to confirm that site-level evacuation and business continuity plans account for short-notice road closures, and to review heat exposure controls for outdoor and physically demanding roles.
