U.S. investigators say a cyberattack that struck dozens of Minnesota water systems this week was likely orchestrated by Iranian hackers.
Minnesota IT Services reported that the coordinated attack targeted operational technology at more than 30 community water systems on Sunday and Monday. The state health department confirmed there were no requests for residents to modify their drinking water usage.
Officials noted that the tradecraft employed and the absence of a ransom demand pointed to a state‑sponsored actor, though the assessment could change as more data is gathered.
Federal agencies, including the FBI, are fully engaged in protecting critical infrastructure and responding to the incident.
The breach focused on control systems that manage municipal water towers. In the city of Braham, a plant operator discovered that the water tower was requesting water while the well was not operating.
After similar problems emerged in at least four other Minnesota communities, Braham staff isolated the compromised system, restored a backup, and restarted the plant within roughly 90 minutes. Residents continued receiving water from the tower, and officials temporarily asked them to conserve water.
Minnesota IT Services emphasized that the investigation remains active and no specific actor has been officially attributed. The agency is collaborating with federal, state, local, tribal and private partners to support affected communities and strengthen infrastructure security.
Assistant Commissioner and Chief Information Security Officer John Israel highlighted the need for a coordinated, whole‑government response to cyber threats against critical infrastructure and outlined ongoing intelligence sharing and defensive measures.
The Cybersecurity and Infrastructure Security Agency reported awareness of multiple potential incidents affecting local water utilities and had issued an advisory warning of Iranian‑affiliated activity targeting internet‑connected operational technology devices.
The FBI’s cyber division reiterated its commitment to identify, disrupt and impose costs on those responsible for targeting U.S. critical infrastructure, including water and wastewater systems.
