Recent cyberattacks have targeted municipal water systems in at least seven states, prompting concerns from the FBI and the Environmental Protection Agency. These incidents highlight vulnerabilities in critical water infrastructure and have led to warnings for utilities nationwide. Hackers have disrupted water operations, but specific states impacted remain unidentified.
A law enforcement official stated that more than 30 municipal water facilities in Minnesota were attacked, exhibiting signs of Iranian involvement, though the investigation is ongoing. Despite breaches, a Minnesota IT agency spokesperson confirmed that no contamination occurred.
The federal advisory warned that malicious cyber actors have targeted control systems brands used by municipal water utilities. Operators are urged to take precautions against potential threats. Water system vulnerabilities at this time are particularly concerning due to rising military tensions involving Iran.
Hackers accessed internet devices remotely, altered IPs and passwords, thus impairing the utilities’ monitoring. To avoid such breaches, the advisory suggests removing programmable logical controllers from direct internet access, securing gateways and firewalls, creating strong passwords, and controlling communications between authorized devices.
The origin of the breaches remains unidentified, with federal and state officials refraining from attributing the Minnesota incident to a particular group. Emily Zimmer from Minnesota’s IT agency explained that determining the source requires thorough analysis of technical data and broader intelligence.
Days before the Minnesota breach, federal agencies noted Iran-backed hackers were targeting critical infrastructure amid escalating tensions between the U.S. and Iran. A public advisory encouraged increased defensive measures against Tehran-linked cyber threats.
Historically, Iran has demonstrated increasing capability and intent to conduct aggressive cyber operations. In 2023, U.S. intelligence indicated that Iranian cyber actors attempted to target water systems.
Previously, in May 2024, the EPA reported heightened frequency and severity in cyberattacks against U.S. water utilities. Roughly 70% of inspected utilities violated standards aimed at preventing such breaches, according to federal findings.