Iran suspected as US investigates cyberattacks targeting water systems across seven states

Cyberattacks on water systems raise urgent questions

A coordinated cyberattack targeted more than 30 community water systems across Minnesota, while the FBI investigated similar incidents involving water and wastewater utilities in at least seven states.

Some Minnesota utilities shifted to manual operations. U.S. officials have examined possible links to Iranian-affiliated hackers, but federal authorities have not publicly issued a final attribution.

How the incident first surfaced

Minnesota officials first detected suspicious activity on Sunday and Monday. State and federal teams then began tracing the technology involved and comparing notes across jurisdictions.

The earliest reports focused on water systems, but the FBI later said incidents appeared in at least seven states. That widened the investigation from a local event into a national security concern.

Why investigators suspect Iran

U.S. officials say the pattern resembles earlier Iran-linked activity, especially attacks on internet-connected controllers. They are still cautious because attribution depends on technical evidence, not assumptions.

Some sources also note the possibility that a threat actor could try to look Iran-based to inflame tensions. That is one reason investigators are treating the case carefully.

The systems most at risk

The main targets were programmable logic controllers, or PLCs, used to monitor and control water equipment. These devices sit close to the operational heart of treatment and distribution networks.

Federal agencies warned that attackers are focusing on internet-exposed industrial controls at water and wastewater utilities. They urged operators to remove publicly exposed devices from the internet immediately.

Little-known fact: Cyberattackers take advantage of vulnerabilities such as unpatched web applications and misconfigured cloud services to compromise target systems and interfere with their functionality.

What happened inside Minnesota

More than 30 municipal water systems were affected in Minnesota alone, according to local and national reporting. In some places, staff lost remote monitoring and had to move quickly to manual mode.

Officials said the drinking water supply itself was not reported compromised. Even so, the incident disrupted operations enough to trigger contingency procedures and emergency coordination.

Braham and the response speed

In Braham, a cyberattack knocked the computerized operating controls for the city’s well and water treatment plant offline. Crews isolated the affected system and restored operations in under two hours.

Mayor Nate George said the city never ran out of water. The episode showed how quickly local teams had to respond when automated water-system controls stopped functioning normally.

South St. Paul and manual mode

outh St. Paul reported an incident affecting automated functions in its water utility and shifted to contingency and manual procedures. Public works employees kept water and wastewater services operating without a reported service interruption.

The response limited the operational impact while investigators and officials addressed the cyber incident.

Plymouth’s disrupted control systems

In Plymouth, the cyber incident affected cellular communications at two water towers and several lift stations. City staff disconnected affected equipment from the network and used manual procedures while the communications systems were restored.

Officials said water levels and water quality remained unaffected, and the water remained safe for residents.

Why the attack mattered nationally

The Minnesota incident came amid existing federal warnings about cyber threats to water and wastewater systems. After the attacks, CISA warned of a significant increase in threats targeting programmable logic controllers, while the FBI said water and wastewater utilities in at least seven states had reported incidents.

Federal officials urged utilities to reduce internet exposure, secure external connections and strengthen protections around operational technology.

What the federal warning said

Officials warned that exposed industrial controls can allow attackers to alter monitoring or disrupt operations. In some confirmed cases, utilities reported loss of control functionality and pressure problems.

The recommended response was practical: remove exposed PLCs, secure operational technology, and strengthen passwords. EPA guidance also stressed keeping PLCs in run mode and limiting internet exposure.

Why water systems remain attractive targets

Water utilities are often small, under-resourced, and dependent on legacy equipment. That makes them difficult to defend while still meeting nonstop public service demands.

Federal reports have repeatedly warned that cyberattacks against water systems are increasing. The sector’s reliance on remote access and internet-connected controllers gives attackers more entry points.

The 2023 precedent

Federal agencies previously said Iran-linked actors used a similar method in 2023. In those cases, attackers exploited internet-connected controllers that still used default passwords.

That history matters because it gives investigators a known playbook to compare with the current case. It also shows that small municipal systems can be targeted even without major national attention.

Curious how foreign policy decisions connect with economic concerns at home? Trump says he doesn’t think about Americans’ finances in Iran talks; offers a closer look at the debate.

What comes next

The investigation is still underway, and officials have not issued a final public attribution. For now, they are combining forensic evidence, intelligence reports, and state-level findings.

The broader lesson is simple: exposed controllers, weak passwords, and internet-facing OT create real risk. Water systems that harden those weak points now will be better prepared for the next attempt.

As debates over security arrangements continue to draw attention, the report says Trump considered awarding himself the Medal of Honor during the Iran conflict, highlighting how political decisions can shape public discussions around military leadership.

Do you believe the U.S. is doing enough to defend essential systems like water utilities from cyber threats? Share your thoughts.

This slideshow was made with AI assistance and human editing.

Read More From This Brand:

• White House warns against insider trading as Iran war triggers concerns over financial ethics and oversight
• Trump calls Iran “a very badly defeated country,” and he doesn’t care about their FIFA status
• The Iran war saw the U.S. military consume huge volumes of coffee and energy drinks to sustain long combat operations