Federal and state officials are investigating a coordinated cyberattack that targeted dozens of public water systems across Minnesota, with early assessments pointing to hackers linked to Iran as the likely perpetrators.
The attacks occurred over July 26 and 27 and affected more than 30 municipal water systems, according to Minnesota IT Services. Although the incidents disrupted operations in several communities, state officials said they have found no evidence that drinking water supplies were compromised.
“There are no indications that the drinking water in any affected community is unsafe to drink,” the agency said in a statement, according to Reuters.
The investigation remains ongoing, and officials cautioned that the attribution could change as additional forensic analysis is completed. However, The New York Times reported that preliminary findings have identified Iranian hackers as the leading suspects.
State officials said approximately 36 water systems were targeted during the coordinated campaign.
Emily Zimmer, a spokesperson for Minnesota IT Services, said investigators have identified similarities between the attacks and previous cyber operations directed at critical infrastructure.
“The timing, methods of access, and targeted infrastructure share characteristics with other coordinated cyber incidents our federal partners have observed involving critical infrastructure,” Zimmer told Reuters.
The FBI confirmed it is actively involved in the investigation.
“The FBI is aware of the incident and in contact with victims to resolve the matter,” agency spokesperson Matthew Vogel said, according to The New York Times.
The attacks temporarily disrupted operations in several communities.
In one Minnesota city, a treatment plant and well were taken offline Monday as officials worked to restore service. Other municipalities were able to continue operating by switching to backup systems or implementing temporary workarounds.
Braham Mayor Nate George said his city’s water system experienced problems after the cyberattack affected equipment connected to the municipal well.
“Public works isolated the affected system, restored a backup and restarted the plant within approximately 90 minutes,” George said.
While service was restored relatively quickly, George argued that the incident exposed broader weaknesses in the cybersecurity protections available to local governments.
“This attack on critical public infrastructure should be a warning to policymakers in St. Paul,” he said.
“Minnesota’s local governments are expected to defend essential systems against foreign adversaries and sophisticated criminals, often with limited staff, aging technology and inadequate resources.”
Federal agencies have warned for months that Iranian-linked cyber groups have expanded their efforts to target American infrastructure.
In April, the Cybersecurity and Infrastructure Security Agency issued an advisory warning that hackers connected to Iran were attempting to gain access to internet-connected industrial control devices used to manage critical infrastructure. The agency updated that warning again in July, citing additional intelligence that suggested the campaign had broadened.
Joe Slowik, director of threat research and cyber engineering at cybersecurity firm Dataminr, said the latest developments fit an emerging pattern.
“CISA’s updated reporting shows a worrying expansion in Iran-linked critical infrastructure targeting focused on the United States,” Slowik said on July 27.
Cybersecurity experts have long cautioned that many of America’s municipal water systems remain particularly vulnerable because they often rely on aging equipment, outdated software, and small information technology staffs that lack the resources available to larger utilities.
