Cyberattacks on US water systems spread to at least seven states, FBI probes possible Iran link

The attacks

Water and wastewater systems across at least seven US states were targeted in a coordinated cyber campaign that began on July 26. Minnesota was the first to report incidents, with 30 sites affected. Michigan later confirmed nine of its systems had been breached. The FBI said that since July 27, utilities in at least seven states had reported incidents, some of which led to disruptions in water operations. The FBI said the attackers targeted programmable logic controllers, remotely accessing internet-facing devices and changing IP addresses and passwords so that utilities could no longer monitor or control their operations. Some switched to manual operation. A Minnesota law enforcement memo assessed that the aim was to contaminate drinking water by dropping pressure in the pipes, and the water has so far tested safe to drink.

Investigation and suspected Iran link

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) are investigating, but no culprit has been publicly identified. An advisory issued before the attacks warned that Iranian hackers were targeting water and wastewater systems and other critical infrastructure. Federal officials privately told The New York Times that Iran is the main suspect. The method matches previous Iranian cyber operations, and no ransom was demanded, making a criminal motive less likely. Nate George, mayor of Braham, Minnesota, said state and federal officials were confident about the source.

We're getting bits of information from the state of Minnesota and the FBI. They're pretty sure it's Iranian actors.

The FBI declined to publicly confirm Iran's involvement. Some investigators, cited by CBS, are examining whether the attacker tried to make it appear as though Iran was responsible to inflame tensions.

Trump's response

President Donald Trump dismissed the Iran link on 31 July at a televised Cabinet meeting at Camp David, blaming the state of Minnesota instead.

We heard in Minnesota there was a cyberattack and they blame it on Iran. I don't think so. I think I blame it on Minnesota because they're grossly incompetent.

Governor Tim Walz rejected the claim on social media, saying Minnesota's own experts had identified the vulnerability quickly and worked with local communities to stop it, and accusing DOGE of having taken an axe to CISA and left the country exposed to cyberattacks.

Trump knows exactly who is responsible for this attack, and knows that other states were hit too. This is what modern warfare looks like, and it further illustrates there's no plan to win a war with Iran.

Impact and safety

No water quality or public health threats have been reported. Dale George, communications director for Michigan's Department of Environment, Great Lakes and Energy, said all systems continued to operate safely after the breaches. Minnesota IT Services noted that most confirmed attacks involved technology used for remote monitoring and control, and as of Thursday there were no active requests for residents to modify water usage, though some modifications had been requested earlier in the week. At least one system in Minnesota was briefly offline, and some communities advised residents to boil water as a precaution.

Broader context

The attacks come five months into the US-Iran war, during which Iran has escalated its cyber operations. In 2023, the Iranian Revolutionary Guard hacked water and wastewater facilities in the US. President Trump has repeatedly threatened to strike civilian infrastructure in Iran, including power and water desalination plants. The FBI said it remains "fully engaged to protect critical infrastructure" and is "well-equipped to protect against cyber threats of all varieties."