A coordinated cyberattack targeting operational technology at more than 30 community water systems in Minnesota and at least six other states has prompted a federal investigation. Agencies including the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the Environmental Protection Agency (EPA) are involved in assessing the threat, with preliminary indications suggesting the involvement of Iran-affiliated threat actors.
The cyberattack, which occurred on Sunday, July 26, and Monday, July 27, affected the computer systems controlling critical infrastructure. In one instance in Braham, Minnesota, the water plant temporarily went offline, requiring crews to rely on stored water while the facility was restored within hours. Other communities reported issues with automated controls or communications equipment, necessitating a switch to manual operations or backup procedures to maintain essential services. Officials confirmed that no active requests were made for residents to reduce or change their drinking water use.
The FBI stated that water or wastewater utility companies in seven states were impacted, with some operations being degraded by the activity. The incident highlights concerns about the vulnerability of local utility systems to cyber threats.
Preliminary Attribution and Wider Warnings
While a definitive attribution has not been announced, a report citing U.S. and state officials suggested that Iranian hackers were likely responsible for the cyberattack. However, President Donald Trump has reportedly rejected this suggestion. Investigators caution that this assessment is preliminary and could change as more technical evidence is collected. The possibility that attackers attempted to make the activity appear Iranian has also not been ruled out.
This incident follows earlier warnings from CISA. In April, the agency alerted that Iranian-affiliated hackers were targeting internet-exposed programmable logic controllers (PLCs), which are used to control machinery at water systems and other critical infrastructure. CISA expanded its warning on July 22 to include equipment from additional manufacturers. Federal officials have not yet publicly linked this specific campaign to the Minnesota incidents.
Vulnerabilities in U.S. Water Systems
Experts note that the vulnerabilities exposed in Minnesota are not unique to the state. The U.S. has approximately 170,000 drinking water and wastewater systems, many of which have connected their physical equipment to internet-enabled technology for remote monitoring. While this allows for easier management of spread-out facilities, it can also provide an entry point for attackers if connections are not adequately secured.
Smaller communities often face greater cybersecurity challenges due to limited resources. The Government Accountability Office has reported widely varying cybersecurity capabilities among water systems, with many using older technology that is difficult to update. Limited budgets often force utilities to prioritize visible repairs over cybersecurity upgrades. Unlike larger utilities that may employ dedicated security professionals, smaller towns might rely on plant operators to manage both daily operations and security.
Potential Consequences and Mitigation Strategies
A cyberattack on a water utility does not automatically lead to contamination. In the Minnesota case, officials reported no known impact on water quality, and residents were advised to continue normal usage. However, the EPA warns that successful attacks could disrupt treatment processes, damage equipment, or interfere with measures that protect water quality.
CISA released guidance titled "CI Fortify: Advice for Isolating Vital Systems" on July 28, urging critical infrastructure operators to separate operational technology from less trusted networks. For water utilities, this includes reducing unnecessary internet exposure and implementing security controls for programmable controllers when remote access is necessary. Utilities are also advised to change default passwords and implement individual employee login credentials, as EPA inspectors have found systems still using factory passwords and shared accounts.
In response to the attack, residents are advised to follow official local instructions, not assume water is contaminated without official notice, ensure emergency alerts are enabled, maintain a small emergency water supply, and be vigilant against fake utility messages or scams.