Get you up to speed: U.S. investigating if Iran was behind cyberattack on water systems in 7 states, including Minnesota
Malicious cyber activity affected over 30 community water systems in Minnesota this week, prompting some utilities to switch to manual operations. Authorities are investigating the incident, which has not resulted in any confirmed compromise of water supply.
Federal agencies are investigating whether the cyber activity was linked to Iranian hackers but have not made a definitive attribution yet. In Minnesota, over 30 water systems were disrupted, though officials confirmed that water supply safety was not compromised during the incident.
President Trump attributed the cyber attack to “gross incompetence” within Minnesota, asserting that the state, rather than Iran, is responsible. In response, Minnesota Governor Tim Walz condemned the federal government’s cybersecurity shortcomings, indicating that ongoing investigations are assessing the true nature of the threat and the level of preparedness needed for future incidents.
What remains unclear — Investigators have not yet confirmed whether all recent cyber incidents were conducted by the same actor.
U.S. probes possible Iranian involvement in cyberattack on water systems in seven states, including Minnesota
Malicious cyber activity affected technology at water systems in at least seven states this week, including Minnesota, forcing some utilities to switch to manual operations as state and federal authorities dig into who is behind the attack, WTX US News has learned.
Investigators are probing to determine whether the activity is the work of Iranian hackers, according to U.S. officials and sources familiar with the incident. Sources cautioned that since they had not definitively attributed the attack, their assessment could change as additional technical evidence is collected. They are also probing whether the actor could have attempted to appear Iran-based as a way of stirring the pot amid the ongoing U.S. conflict with Iran.
The FBI reported incidents in “at least seven states” but didn’t identify them.
WTX US News has learned more than 30 community water systems across Minnesota were affected. Minnesota and the federal government have not publicly attributed the activity to a particular actor.
Even as the investigation continues, President Trump said Friday that he doesn’t think Iran is to blame. Instead, he pointed the finger at Minnesota and its Democratic governor, Tim Walz, who is no stranger to criticism from the president.
“I think that Minnesota is behind it,” Mr. Trump said during a televised Cabinet meeting at Camp David. “You know who’s behind it? Minnesota. Because they’re grossly incompetent. I think the governor’s behind it. I don’t think there was an Iranian cyberattack. I think that Minnesota ought to get its act together.”
“They like to say, ‘Oh, it was Iran.’ Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota,” the president said.
Following Mr. Trump’s accusations, Walz said on social media that the Trump administration “took an axe” to the federal Cybersecurity and Infrastructure Security Agency and “left the U.S. exposed to cyber attacks.”
“Trump knows exactly who is responsible for this attack, and knows that other states were hit too,” Walz said. “This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran.”
Iran-linked hackers have previously targeted U.S. water utilities. Federal agencies confirmed previously that actors affiliated with Iran’s Islamic Revolutionary Guard Corps used a similar playbook, accessing multiple water and wastewater facilities in 2023 by exploiting internet-connected controllers that retained their default passwords.
Officials warned of water systems being targeted
The FBI, Environmental Protection Agency and CISA all warned Thursday that attackers are targeting internet-exposed industrial controllers used by water and wastewater utilities.
In at least some cases, federal authorities reported loss of monitoring and control functionality at critical infrastructure sites, leading to pressure loss and flooding.
Most confirmed cases in the Minnesota cyberattack involved technology used to remotely monitor and control water system equipment, including devices called programmable logic controllers, according to Minnesota IT Services.
None of Minnesota’s water supply has been reported compromised as a result of the attack, Mike Ernster, a public information officer for the Minnesota Department of Public Safety, told WTX US News. The Bureau of Criminal Apprehension’s Minnesota Fusion Center was working with municipalities, as well as state and federal partners, to address the issue, he added.
AP Photo/Ellen Schmidt 
Nick Anderson, acting director of CISA, confirmed that the agency “is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLC) at water utilities.”
“We urge critical infrastructure owners and operators to remove publicly exposed PLCs and other operational technology from the internet as soon as possible,” he added.
Minnesota said investigators identified some similarities in the timing of the recent incidents, in addition to the types of technology impacted, but had not yet confirmed that every incident was carried out by the same actor.
A spokesperson for the city of South St. Paul told WTX US News it identified an issue early Monday and immediately implemented contingency procedures. Public works employees transitioned to manual operations, allowing water and wastewater services to continue without any interruption to service. The city added that the incident was limited to technology supporting portions of its water utility, while drinking water treatment, quality, pressure and delivery were not impacted.
Officials in South St. Paul found no indication that resident or customer data was accessed.
In Braham, located in a more rural area north of Minneapolis, public works personnel also discovered the problem Monday after noticing the well supplying the city’s water tower was malfunctioning. Workers isolated the affected system, restored a backup and restarted the plant in about 90 minutes, Mayor Nate George confirmed to WTX US News.
Residents experienced no loss of water service, George added. The city’s water tower typically holds enough drinking water to last about two days, and operators discovered the problem before receiving an automated alert, leading the city to believe the pump had been offline for only a brief period. The city has since ensured the system is not connected to any public-facing internet networks and is meeting with its technology provider about remediation.
In suburban Plymouth, Minnesota, officials detected an outage Sunday evening after noticing compromised PLCs at two water towers and 14 sewer lift stations, then disconnecting them from the cellular network.
A city official in Plymouth told WTX US News that operators moved into a manual operation mode temporarily until the systems were brought back online, with normal communications restored by Tuesday afternoon. Still, officials say water quality, treatment and pressures were never affected, with delivery remaining undisrupted throughout.
“I think you never expect it to happen to you,” Thompson said.
CISA said Thursday that it’s “currently observing a significant increase in cyber threat actors” that are targeting PLCs in the Water and Wastewater Systems sector, noting those actors are targeting “water entities of all sizes.”
“CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible,” said CISA, which is part of the Department of Homeland Security.
“Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans,” CISA added in its advisory.