US investigators probe Iranian link to cyberattacks on water systems in seven states

Federal investigators are examining whether Iranian actors were behind cyberattacks that affected technology at water systems in at least seven states this week, according to CBS News reporting. The FBI reported incidents in 'at least seven states' but did not identify them publicly. In Minnesota alone, more than 30 community water systems were affected, per the reporting.

Investigators are probing to determine whether the activity is the work of Iranian hackers, but sources cautioned that they 'had not definitively attributed the attack,' and their assessment could change as additional technical evidence is collected. Investigators are also examining whether 'the actor could have attempted to appear Iran-based as a way of stirring the pot amid the ongoing U.S. conflict with Iran,' suggesting that false-flag attribution is part of their working hypothesis. Minnesota and the federal government have not publicly attributed the activity to a particular actor.

President Trump said Friday that he does not believe Iran is to blame. During a televised Cabinet meeting at Camp David, Trump stated: 'I think that Minnesota is behind it. You know who's behind it? Minnesota. Because they're grossly incompetent. I think the governor's behind it. I don't think there was an Iranian cyberattack. I think that Minnesota ought to get its act together.' Trump added: 'They like to say, Oh, it was Iran. Iran should be so lucky. Iran's got bigger problems than worrying about Minnesota.' Governor Tim Walz countered on social media that the Trump administration 'took an axe' to the federal Cybersecurity and Infrastructure Security Agency and 'left the U.S. exposed to cyber attacks.' Walz said: 'Trump knows exactly who is responsible for this attack, and knows that other states were hit too. This is what modern warfare looks like, and it further illustrates there's no plan to win a war with Iran.'

Actors affiliated with Iran's Islamic Revolutionary Guard Corps used a similar playbook in 2023, accessing multiple water and wastewater facilities by exploiting internet-connected controllers that retained their default passwords, according to CBS News reporting. The FBI, Environmental Protection Agency, and CISA all warned Thursday that attackers are targeting internet-exposed industrial controllers used by water and wastewater utilities. In at least some cases, federal authorities reported loss of monitoring and control functionality at critical infrastructure sites, leading to pressure loss and flooding.

Most confirmed cases in the Minnesota cyberattack involved technology used to remotely monitor and control water system equipment, including devices called programmable logic controllers (PLCs). Nick Anderson, acting director of CISA, confirmed that the agency 'is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLC) at water utilities.' CISA urged: 'We urge critical infrastructure owners and operators to remove publicly exposed PLCs and other operational technology from the internet as soon as possible.'

Municipal officials reported limited operational disruption and no actual impact to water quality or service. South St. Paul identified an issue early Monday and immediately implemented contingency procedures, with public works employees transitioning to manual operations; the incident was limited to technology supporting portions of its water utility, while drinking water treatment, quality, pressure, and delivery were not impacted. Officials found no indication that resident or customer data was accessed. In Braham, public works personnel discovered the problem Monday after noticing a malfunctioning well; workers isolated the affected system, restored a backup, and restarted the plant in about 90 minutes, with residents experiencing no loss of water service. In suburban Plymouth, officials detected an outage Sunday evening after noticing compromised PLCs at two water towers and 14 sewer lift stations; officials disconnected the affected systems from the cellular network and moved into manual operation mode temporarily, with normal communications restored by Tuesday afternoon and water quality, treatment, and pressures never affected. Minnesota said investigators identified some similarities in the timing of the recent incidents and in the types of technology impacted, but had not yet confirmed that every incident was carried out by the same actor.