US water facilities targeted by ‘malicious cyber actors’ – who’s to blame?

A water tower in Plymouth, Minnesota last week.

At least 30 systems in Minnesota have been targeted.

Despite Trump’s efforts to blame Tim Walz and Minnesota, officials suspect Iran behind attacks on US infrastructure Late last week, federal authorities issued a stern warning saying “malicious cyber actors” were targeting water and wastewater facilities in at least seven states across the US.

Minnesota appeared to be the hardest hit with 30 of its water systems hit by cyber-attacks, leading to disruptions in the state’s water supply.

The problems ranged from low-pressure water flow in people’s homes to some utilities announcing boil-water notices.

But there have been no reports of drinking water contamination.

“These threat actors are targeting water entities of all sizes,” the US Cybersecurity and Infrastructure Security Agency (CISA) said in a statement last Thursday.

The agency highlighted the fact that critical infrastructure systems can be especially vulnerable to cyber-attacks in the digital age.

Much of the problem stemmed from water facilities’ connection to the internet, which made it possible for hackers to infiltrate, change passwords and lock out operators.

To mitigate continued disturbances, the agency advised utilities to take their systems offline and switch to manual mode.

The culprit of the coordinated attack is suspected to be Iran, according to officials across the government who have spoken anonymously to various news outlets.

Tehran has reportedly stepped up its cyber-attacks on the US since the war began nearly six months ago, but so far has only had nominal success.

While the FBI announced that it opened an investigation into the hack, it stopped short of putting the responsibility on Iran.

Donald Trump, however, has said the attack is Minnesota’s fault.

“I blame it on Minnesota because they’re grossly incompetent,” Trump said at a cabinet meeting last Friday at Camp David in Maryland, without providing evidence to support his claims.

“I would blame it on Minnesota and the governor, the corrupt governor of Minnesota … Iran’s got bigger problems than worrying about Minnesota.” Tim Walz, the governor of Minnesota, fired back in a post on X: “Trump knows exactly who is responsible for this attack, and knows that other states were hit too.

This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran.” The exact groups behind the cyber-attacks are still unclear Law enforcement and cybersecurity agencies have not publicly identified which hacking group or groups are behind this past month’s attacks, nor have they directly accused the Iranian government of orchestrating them.

But, several outlets, including The New York Times and Washington Post, have detailed unnamed government officials claiming that Iran is likely behind the hacks.

CISA previously issued a warning in April about Iranian-backed cyber-attacks targeting critical infrastructure, specifically the programmable logic controllers that are used in water systems.

The agency updated its advisory on 22 July to give additional guidance on how to secure systems against attacks and named which manufacturers could be vulnerable.

“The authoring agencies urgently warn US organizations of ongoing Iranian-affiliated cybertargeting of internet-connected operational technology,” CISA said in its advisory.

Foreign-backed cyber-attacks have repeatedly targeted water infrastructure in recent years.

In 2024, several rural Texas towns were hit with Russian-linked cyber-attacks that briefly caused the tiny town of Muleshoe’s water system to overflow.

In 2023 and 2024, a hacking group linked to Iran targeted the industrial computers that controlled some of Pennsylvania’s water systems.

Lawmakers from the state warned the federal government at the time that similar attacks could take place across the country.

The incidents have also led to calls from cybersecurity experts and industry groups for the US government to address vulnerable infrastructure and invest into their defense.

“This week we are facing a reckoning of the consequences of ignoring the importance of investing in our nation’s cybersecurity for our critical infrastructure,” Tatyana Bolton, executive director of the industry group Operational Technology Cybersecurity Coalition, said in a statement urging federal action on the matter.

The coalition, which is made up of prominent infrastructure and cybersecurity companies, called on the government to reinstate and fund the state and local cybersecurity grant program, which is set to expire in September.

The grant program was established in 2021 as a $1bn fund for shoring up critical infrastructure.

“By not extending this grant program, Congress is leaving small towns to protect themselves from nation-state actors like Iran,” Bolton stated.

In some cases, hacking groups have taken credit for their cyber-attacks or investigators have named alleged perpetrators, but often the provenance of hacks remains unclear.

Explore more on these topicsHacking Cybercrime Internet Minnesota Iran US foreign policy explainers Share Reuse this content