US water cyberattacks spread across states as FBI investigates possible Iran link

Cyberattacks targeting United States drinking water and wastewater infrastructure have expanded beyond Minnesota, with Michigan confirming attempted intrusions at nine water systems as federal authorities investigate related malicious activity across several states.

Minnesota IT Services confirmed that more than 30 community water systems were targeted during a coordinated cyberattack on July 26 and July 27, 2026. Michigan authorities disclosed the additional incidents on August 1, bringing renewed attention to weaknesses in operational technology used by small and medium-sized utilities.

All affected Michigan systems were operating safely, and officials had identified no threat to drinking water quality or public health. Minnesota also reported no confirmed contamination, although attacks caused temporary operational problems in communities including Braham and Plymouth.

The Federal Bureau of Investigation, Environmental Protection Agency and Cybersecurity and Infrastructure Security Agency are supporting state and local investigations. Federal officials are examining whether similar activity affected water systems in at least seven states.

No government agency had publicly identified the attacker by August 2. Recent federal advisories warned that Iran-affiliated cyber actors were attempting to access programmable logic controllers and other operational technology used by water utilities, but investigators had not formally attributed the latest campaign to Iran.

The incidents demonstrate that cyber access to a water utility can create physical consequences even when drinking water remains safe. Attackers who reach operational controls may be able to interrupt pumps, alter tank levels, change pressure settings or disable automated treatment functions.

What happened when cyberattackers targeted more than 30 Minnesota water systems?

The Minnesota campaign targeted operational technology at more than 30 community water systems on July 26 and July 27.

Operational technology refers to the hardware and software that monitor and control physical processes. In a water system, those processes can include pumping, treatment, storage, pressure management and the movement of water through distribution networks.

Minnesota IT Services activated the state’s cybersecurity incident-response capabilities and began working with federal agencies, local governments, Tribal authorities and private-sector specialists.

The attacks did not produce a statewide shutdown or confirmed change in drinking water quality. However, several communities experienced disruptions that showed the intruders had reached systems connected to physical operations.

Braham temporarily lost automated control of its well and water treatment plant. The community continued relying on water stored in its tower while personnel restored operations and asked residents to conserve water.

Plymouth experienced a temporary communications outage involving water infrastructure. Residents were also asked to limit water consumption while officials examined the incident and confirmed that essential services remained available.

The Minnesota attacks appeared coordinated because numerous utilities were targeted within a short period and through similar operational technologies. Investigators have not disclosed whether every intrusion used the same vulnerability, compromised credentials or internet-connected device.

The campaign did not require attackers to penetrate a large state network. Water utilities often operate separate local systems, meaning attackers may have identified similar equipment or security weaknesses across multiple communities.

How did nine Michigan water utilities become part of the expanding cyber investigation?

Michigan disclosed on August 1 that malicious cyber activity had affected technology used by nine water systems.

State authorities did not publicly identify the affected communities, describe the exact equipment accessed or disclose whether attackers successfully manipulated physical processes.

Michigan officials confirmed that all nine systems remained safe and operational. No public-health advisory, boil-water notice or confirmed contamination was linked to the Michigan incidents.

The disclosure nevertheless expanded the geographical scope of the investigation. The campaign was no longer limited to a cluster of Minnesota utilities and appeared capable of reaching systems under different state and local administrations.

Michigan’s Department of Environment, Great Lakes, and Energy maintains cybersecurity guidance for the water sector and encourages utilities to seek immediate criminal investigative support after identifying a critical incident.

The state’s response required coordination between water regulators, cybersecurity personnel, law enforcement agencies and individual utility operators. Local systems must protect evidence while restoring service, making it important that staff do not erase logs or reset equipment before investigators collect necessary information.

Officials had not confirmed whether the Michigan and Minnesota attacks were directed by the same organisation. Similar targeting can result from one coordinated campaign, several groups exploiting the same vulnerability or opportunistic attackers responding to publicly known weaknesses.

The Federal Bureau of Investigation’s involvement indicates that authorities are examining the incidents as more than isolated technical failures. Investigators will compare indicators including internet addresses, malware, login attempts, device models and commands sent to operational equipment.

Why are programmable logic controllers creating a national water security concern?

Programmable logic controllers are industrial computers used to automate physical machinery and processes. Water utilities rely on them to operate pumps, valves, chemical dosing equipment, tanks and treatment systems.

Many programmable logic controllers were designed for reliability and long service rather than modern cybersecurity. Some remain in operation for decades and may use outdated software, weak authentication or insecure internet connections.

Utilities increasingly connect industrial equipment to remote monitoring platforms so employees and contractors can manage facilities without remaining on-site. Remote access can improve efficiency, particularly for small systems with limited personnel.

The same connection can expose equipment to attackers when default passwords remain unchanged, remote services are publicly accessible or security updates are not installed.

The Cybersecurity and Infrastructure Security Agency warned on July 22 that Iran-affiliated cyber actors were exploiting programmable logic controllers across several sectors, including United States water and wastewater systems.

A subsequent federal alert urged water utilities to identify internet-exposed operational technology, change default credentials, restrict remote access and separate industrial control networks from ordinary business systems.

Attackers do not necessarily need sophisticated malware when equipment is directly reachable from the internet. Stolen passwords, unchanged manufacturer credentials or poorly protected remote-management tools may provide sufficient access.

The latest campaign therefore raises a basic infrastructure question: whether utilities know which operational devices are connected to external networks and whether each connection is genuinely necessary.

Has the United States confirmed that Iran carried out the water system attacks?

No federal agency had publicly attributed the Minnesota and Michigan attacks to Iran by August 2.

The possible Iran connection arises from intelligence warnings issued before the incidents and from similarities between the targeted equipment and earlier activity associated with Iran-affiliated cyber groups.

United States agencies warned during 2026 that Iranian actors were increasing activity against critical infrastructure amid the continuing military conflict between the United States and Iran.

Previous Iran-linked operations have targeted water equipment manufactured in Israel or used weak internet security to access industrial systems. United States authorities have also prosecuted Iranian nationals over earlier attempted intrusions into infrastructure.

Those precedents make Iran a significant investigative possibility, but they do not prove responsibility for the latest campaign.

Cyber attribution requires technical, intelligence and operational evidence. Investigators must determine who controlled the attacking infrastructure, whether tools were deliberately copied from another group and whether a government directed or supported the activity.

Hackers can route operations through servers in several countries and use previously leaked software to conceal identity. A group may also falsely claim responsibility or deliberately imitate an adversary.

The absence of immediate attribution is therefore not unusual. Authorities must avoid converting a reasonable suspicion into a confirmed finding before the evidence is complete.

Did the cyberattacks place drinking water quality or public health in immediate danger?

Authorities reported that drinking water remained safe in both Minnesota and Michigan.

There was no confirmed evidence that attackers altered chemical treatment levels, introduced contaminants or made water unsafe for consumption.

The operational disruptions were still serious because water quality depends on continuous control of treatment, pressure and distribution.

A disabled pump can reduce water pressure, limiting service to homes, hospitals and fire departments. Pressure loss may also increase the risk that contaminants enter damaged distribution pipes.

Manipulating chemical dosing equipment could create under-treatment or excessive chemical concentrations. Changing tank levels may cause shortages, overflow or damage to pumps.

The Minnesota incidents demonstrated that attackers could interfere with automated controls, even though utility staff maintained safe service through stored water, manual operations and emergency response.

Water systems are designed with alarms, laboratory testing and human oversight that can detect abnormal conditions. Those safeguards reduce risk but may not prevent every consequence if an attacker remains undetected.

The lack of contamination should therefore be treated as a successful containment outcome rather than evidence that the intrusions were harmless.

Why are smaller United States water utilities especially vulnerable to cyberattacks?

The United States water sector includes tens of thousands of drinking water and wastewater systems that vary significantly in size, funding and technical capacity.

Large metropolitan utilities may employ dedicated cybersecurity teams and maintain redundant control systems. Smaller communities often depend on a few employees, part-time contractors or external technology vendors.

Cybersecurity must compete with urgent physical needs such as replacing pipes, repairing pumps, meeting water-quality standards and maintaining treatment plants.

Legacy operational equipment can remain functional for many years, making replacement difficult to justify until a major failure or cyber incident occurs.

Small utilities may also use consumer-grade routers, shared accounts or remote-access tools configured for convenience rather than security. Contractors may retain access after projects end, while passwords can remain unchanged for long periods.

Federal agencies provide guidance and technical assistance, but voluntary recommendations are implemented unevenly. Local governments may lack the personnel required to interpret complex security advisories or assess industrial networks.

The fragmented structure also complicates national visibility. A federal agency may not know that several small systems are experiencing similar attacks until state authorities or vendors connect the incidents.

The Minnesota campaign illustrates how attackers can gain scale by exploiting a common weakness across many small targets rather than attempting to penetrate one heavily defended national system.

What steps are federal agencies asking water and wastewater systems to take?

The Cybersecurity and Infrastructure Security Agency has urged utilities to remove unnecessary operational technology from direct internet access.

Systems that require remote connectivity should be protected through secure gateways, multifactor authentication, restricted user accounts and monitoring capable of identifying unusual activity.

Utilities should change default passwords, eliminate shared credentials and disable accounts belonging to former employees or contractors.

Operational networks should be separated from email, payroll and administrative systems. Segmentation can prevent an attacker who compromises an office computer from moving directly into treatment controls.

Facilities also need reliable offline backups of configurations and control programmes. Backups allow staff to restore equipment after attackers change settings or delete software.

Manual operating procedures remain essential. Employees must be able to run critical pumps and treatment processes when automated controls or communications become unavailable.

Utilities should continuously monitor water pressure, chemical levels, tank status and equipment behaviour rather than relying only on digital alarms that an attacker may manipulate.

Incident-response plans must identify who contacts law enforcement, regulators, cybersecurity agencies, laboratories and the public. Early reporting can reveal whether the same attacker is targeting other communities.

Could attacks on water systems become part of the wider United States-Iran conflict?

Critical infrastructure cyberattacks can provide governments and aligned groups with a way to create disruption without launching conventional military weapons.

Water systems are attractive targets because they are locally managed, technologically varied and directly connected to public safety.

A limited intrusion may generate fear even when no contamination occurs. Attackers can demonstrate access, force emergency spending and require federal agencies to divert resources to investigation and protection.

Iran-affiliated cyber groups have previously combined ideological messaging with opportunistic attacks on poorly protected systems. Such operations may be intended to retaliate politically rather than produce mass casualties.

The latest campaign occurred during an active military confrontation between the United States and Iran, increasing concern that cyber operations could become another front in the conflict.

However, official attribution remains essential before treating the incidents as Iranian state action. Cybercriminals, hacktivists and other governments may exploit the same period of tension to conceal their own operations.

A premature response could escalate the conflict on the basis of incomplete evidence. A delayed response could allow attackers to continue probing vulnerable infrastructure.

The immediate priority is therefore operational resilience, technical investigation and evidence preservation rather than political attribution without proof.

What are the key takeaways from the United States water infrastructure cyberattacks?

• A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and July 27, prompting a statewide cybersecurity response involving local, state, federal and private-sector partners.
• Michigan confirmed on August 1 that malicious cyber activity had affected technology at nine water systems, although all affected utilities continued operating safely and no public-health threat was identified.
• Federal investigators were examining related activity across at least seven states, but authorities had not publicly disclosed every affected location or confirmed that all incidents were conducted by the same organisation.
• Braham temporarily lost automated control of its well and water treatment plant, while Plymouth experienced a communications disruption, demonstrating that cyber access can affect physical water operations without contaminating drinking supplies.
• The Federal Bureau of Investigation, Environmental Protection Agency and Cybersecurity and Infrastructure Security Agency are supporting the investigation, but no agency had officially attributed the latest attacks to Iran or another actor.
• Federal warnings issued before the incidents identified continued Iran-affiliated efforts to exploit programmable logic controllers and other operational technology used across water, wastewater and additional United States infrastructure sectors.
• Small water utilities face heightened exposure because many depend on ageing industrial equipment, limited cybersecurity personnel, remote-access systems, shared credentials and operational technology that may remain directly accessible through the internet.
• Federal agencies are urging utilities to remove unnecessary internet connections, change default passwords, strengthen remote authentication, separate operational networks, maintain offline backups and prepare manual procedures for continuing essential services.