Federal and state officials in the U.S. are investigating a series of cyberattacks on water and wastewater systems in at least seven states this week, with multiple media reports linking the attacks to Iran.
The FBI said Thursday that “some of that activity has degraded water operations,” which the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said has led to communities issuing boil water notices and switching to manual operations.
Those agencies and others are warning water facilities to disconnect vulnerable equipment from the internet — particularly programmable logic controllers (PLCs) — to prevent further attacks.
“These threat actors are targeting water entities of all sizes,” CISA said in an advisory Thursday.
“Even water organizations with mature cybersecurity processes should validate their external connections.”
The attacks come days after CISA updated and recirculated an advisory last week warning “Iranian-affiliated cyber actors” were exploiting PLCs across U.S. critical infrastructure, including water systems.
Warnings about Iranian cyber threats have increased since the U.S. and Israel launched the war on Iran in late February.
However, officials have not yet publicly linked this week’s water system attacks to a specific threat actor, and U.S. President Trump dismissed the possibility of Iranian involvement on Friday while disparaging leaders in Minnesota, one of the affected states.
Here’s what to know about what’s going on.
PLCs are internet-connected computer devices used to remotely control and monitor industrial operations.
The devices allow for geographically dispersed systems to be controlled from a central office, which can be particularly useful for large urban communities. For water systems, PLCs can be integrated into dams, pumping stations, treatment facilities and other infrastructure.
A November report from the Canadian Centre for Cyber Security on the threat to water systems notes, however, that “the more internet-connected assets an organization has, the larger the threat surface” that can be exploited by criminal hackers.
CISA’s July 22 advisory says Iranian-affiliated cyber actors have been using third-party programming software to gain remote access to specific PLCs, extract program data, and manipulate it to allow water systems to “enter unsafe conditions” without notifying operators, bypassing critical shutdown and alarm procedures.
The attacks appear to have begun in Minnesota on Sunday and Monday, according to a statement from the state’s IT services department (MNIT) on Tuesday.
The agency said in an update Thursday that more than 30 community water systems across Minnesota were targeted, but there have not been any requests from affected communities for residents to modify their drinking water use.
Get weekly health news
Receive the latest medical news and health information delivered to you every Sunday.
“In this situation, ‘impacted’ means investigators confirmed malicious activity involving a system’s technology,” the statement said. “It does not mean every affected community experienced a disruption to water service.”
CNN, citing a memo it obtained from Wisconsin’s Department of Natural Resources, reported officials in that state warned they had detected malicious cyber activity at their water facilities on Monday.
The FBI advisory did not name the seven states it says have reported cyberattacks since Monday.
It said the attacks involved changing IP addresses and passwords for water systems’ PLCs, “resulting in a loss of monitoring and control functionality.”
“Operational effects reported to the FBI have included loss of pressure and flooding,” the advisory says. “Pressure loss in water systems could potentially allow untreated ground water to seep into pipes.”
Thursday’s MNIT statement said Minnesota “has not attributed the activity to a specific actor,” noting investigators have yet to confirm every incident is connected but have identified “similarities.”
“We have provided relevant information to the federal government, which is evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor,” John Israel, Minnesota’s chief information security officer, said in the statement.
Multiple U.S. news outlets, including the New York Times, CNN and CBS News, citing federal and state sources familiar with the investigation, reported Thursday and Friday that Iran is believed to be involved.
The Water Information Sharing and Analysis Center (WaterISAC), which co-ordinates cybersecurity information for the U.S. water utility industry, confirmed Thursday the existence of a memo leaked to Wired that linked the Minnesota attacks to “Iran-affiliated” hackers.
That memo, according to Wired, cited information from the Minnesota Fusion Center, a state intelligence-sharing agency, saying the attacks were “aligned” with methods outlined in the CISA advisory first published in April and updated this month.
Asked about the Wired report during a cabinet meeting Friday, Trump pinned the blame for the cyberattack on Minnesota’s government, which the U.S. president has repeatedly attacked for its response to fraud allegations against immigrant communities accessing state funds.
“You know who’s behind it? Minnesota, because they’re grossly incompetent,” Trump told reporters. “I think the governor’s behind it. I don’t think there was an Iranian cyberattack. I think that Minnesota ought to get its act together.
“They like to say, ‘Oh, it was Iran,’” Trump continued. “Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota.”
After Trump spoke, Minnesota Gov. Tim Walz posted on X that “Trump knows exactly who is responsible for this attack, and knows that other states were hit too.”
“This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran,” he wrote.
Walz further alleged that federal funding cuts to CISA have “left the U.S. exposed to cyber attacks,” while his state’s authorities were able to mitigate the water system attacks.
The FBI and CISA are urging all organizations that use PLCs to disconnect them from the public-facing internet and ensure remote modems connected to the systems are secured.
Passwords should be changed and strengthened, with additional access safeguards, such as firewalls, installed.
The agencies say manual overrides should also be maintained and practiced in the event of an incident.
The Canadian Cyber Centre report also contains several mitigation measures that organizations can take to secure their own PLC systems.
