US water systems hit by cyberattacks in at least 7 states; Michigan, Minnesota confirm breaches

Cyberattacks targeting water and wastewater systems have struck at least seven U.S. states since the last week of July, federal and state officials confirmed on Saturday. Michigan is the latest state to disclose breaches, joining Minnesota, which had already reported more than 30 affected systems. The FBI is leading the investigation amid private intelligence assessments that Iran is the likely culprit.

Scope and timing

According to the FBI, operators in at least seven states have reported incidents since July 27. A joint FBI and Environmental Protection Agency alert said the actors targeted internet-facing Rockwell Automation Allen-Bradley MicroLogix programmable logic controllers, changing IP addresses and passwords, with reported effects including pressure loss and flooding. The agency said no known risk to public health had materialized, but acknowledged that “some of these activities have degraded water operations.”

The FBI and our interagency partners are fully engaged to protect critical infrastructure, and we remain well-equipped to protect against cyber threats of all varieties.

Michigan’s Department of Environment, Great Lakes, and Energy said it received a federal cyber alert on Tuesday and subsequently fielded a small number of reports matching the described activity. By Saturday the tally reached nine systems. Dale George, the department’s communications director, said all systems continued to operate safely and that local operators resolved the issues without known impacts on public health.

Incidents on the ground

In Minnesota, the city of Braham (population 1,700) asked residents to minimize water use for several hours on Monday after its water plant went offline. A city news release attributed the outage to a cyberattack that disabled the operating controls for its well and treatment plant, forcing Braham to rely temporarily on its water tower. No water-quality problems were reported. In Plymouth, a suburb of Minneapolis with about 80,000 residents, officials said water infrastructure communications were restored by Tuesday afternoon following an attack. Minnesota IT Services clarified that most confirmed attacks involved remote monitoring and control equipment, and not every impacted community experienced a water service interruption.

The Iran suspicion

Although the FBI has not publicly named a suspect, multiple U.S. officials told The New York Times that Iran is privately considered the primary culprit. The attacks occurred one week after the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and other agencies warned that Iranian hackers were increasingly targeting water and wastewater systems, as well as the operational controls of other critical infrastructure sectors. State officials briefed on the investigation told NBC News that the tradecraft used and the absence of any ransom demand led analysts to point to Iran. In 2023 actors affiliated with Iran’s Islamic Revolutionary Guard Corps, operating as CyberAv3ngers, breached water and wastewater facilities in the U.S. by exploiting internet-connected controllers left on default passwords, most prominently at the Municipal Water Authority of Aliquippa in Pennsylvania, and cyber operations have escalated since the five-month-old open war between Washington and Tehran, whose most recent ceasefire attempt collapsed.

The mayor of Braham, Nate George, said state and federal officials had pointed to Iran in private.

We’re getting bits and pieces of information from the state of Minnesota and the F.B.I. They are pretty sure it’s Iranian actors.

Trump blames Walz

President Donald Trump dismissed the Iran intelligence on Friday and instead pointed to Minnesota’s Democratic governor, Tim Walz. “I think Minnesota is behind it,” Trump told reporters. Walz fired back on social media, saying Trump knew exactly who was responsible and calling the attacks modern warfare. CNN described the claim against Minnesota as baseless.

Trump knows exactly who is responsible for this attack, and knows that other states were hit too. This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran.

CISA has separately warned that Iran-linked individuals are targeting government services, water systems, and the energy sector, urging operators to secure internet-exposed equipment.