U.S. investigators suspect Iranian hackers are likely responsible for a cyberattack that recently targeted operational technology at more than 30 community water systems in Minnesota, according to a report.
The coordinated cyberattack occurred on Sunday and Monday, impacting systems used to manage and monitor water towers operated by municipal governments. Minnesota IT Services (MNIT) confirmed the incident but stated the Minnesota Department of Health is not aware of any requests for residents to alter their water usage.
Officials familiar with the investigation told The New York Times that the tradecraft employed and the absence of a ransom demand led analysts to an initial assessment pointing to Iran. However, officials cautioned that this assessment could change as more data becomes available.
The FBI acknowledged awareness of the reports concerning the water and wastewater sectors. "The FBI and our interagency partners are fully engaged to protect critical infrastructure and we remain well-equipped to protect against cyber threats of all varieties," the FBI said in a statement.
In the city of Braham, a plant operator discovered on Monday that the water tower was calling for water, but the well was not operating. After learning of similar issues in at least four other Minnesota communities, Braham staff determined the plant's computerized control system had been compromised. Public works isolated the affected system and restored a backup, restarting the plant within approximately 90 minutes. During this time, residents continued to receive water from the city's tower, and an temporary request for water conservation was issued to prevent the tower's limited supply from being depleted.
MNIT stated that the investigation remains active and the state has not yet attributed the activity to a specific actor. The agency is collaborating with federal, state, local, Tribal, and private-sector partners to investigate the attack, support affected communities, and enhance the security of Minnesota's critical infrastructure.
John Israel, MNIT Assistant Commissioner and Minnesota Chief Information Security Officer, told The Times that the breach was first detected on Sunday and that hackers targeted 36 municipal water systems. He noted that while Minnesota was an early detector, similar threat activity has likely been occurring in other states.
The Cybersecurity and Infrastructure Security Agency (CISA) had issued an advisory in the days leading up to the incident, warning U.S. organizations of ongoing Iranian-affiliated cyber activity targeting internet-connected operational technology devices. The advisory stated that Iranian cyber actors continue to target U.S. critical infrastructure, including water and wastewater systems, energy, and government facilities.
Assistant Director Brett Leatherman of the FBI’s Cyber Division emphasized the FBI's commitment to identifying, disrupting, and imposing costs on those responsible for such attacks.