U.S. Water Utility Cyberattacks: What We Know About Iran Link

A wave of cyberattacks against U.S. water utilities has disrupted operations in several states and renewed concerns about the security of internet-connected equipment used in critical infrastructure. Iran-linked hackers are a major focus of the investigation, although the U.S. government has not publicly attributed the full campaign to Tehran.

The incidents have been reported across at least seven states, according to the FBI, with some attacks affecting water operations. Minnesota experienced one of the largest known clusters, with authorities reporting coordinated attacks against water treatment systems serving more than 30 communities.

Water utility cyberattacks spread across several states

Minnesota authorities disclosed the attacks in late July. Additional incidents have since been reported involving water facilities in Arkansas, Georgia, Michigan and New Jersey.

In some cases, the disruption went beyond unauthorised access. The FBI said attacks caused problems including loss of water pressure and flooding. Reduced pressure can create additional risks because untreated groundwater may enter pipes when system pressure falls.

Braham, Minnesota, temporarily took its water plant offline and asked its roughly 1,700 residents to conserve water. Maple Plain briefly declared a state of emergency, while officials in a county near Atlanta issued a precautionary boil-water advisory following an incident.

The scale of the campaign is notable because the United States has more than 150,000 water systems, many of which are operated locally. That decentralised structure creates numerous potential targets, including smaller operators with limited cybersecurity staff and resources.

Iran suspected, but public attribution remains incomplete

The U.S. government has not formally identified who carried out the entire wave of attacks. However, the incidents followed warnings from the Cybersecurity and Infrastructure Security Agency about Iran-affiliated cyber actors targeting internet-connected equipment in water and energy systems.

CISA had previously warned that Iranian actors were targeting exposed operational technology and industrial control equipment. Such devices can sometimes be accessible via the public internet, particularly when organisations have not properly secured their remote management systems.

WaterISAC, a nonprofit cybersecurity information-sharing organisation for the water sector, told members that the recent incidents aligned with the Iran-linked campaign identified by CISA, according to reporting by Wired.

The Washington Post later reported, citing people familiar with U.S. intelligence assessments, that agencies were confident Iran was responsible and that the Islamic Revolutionary Guard Corps was connected to the operation. The report said officials had not determined which specific IRGC unit was involved. That assessment has not been announced as a formal U.S. government attribution.

President Donald Trump publicly questioned whether Iran was responsible after the Minnesota incidents, saying he did not believe there had been an Iranian cyberattack.

Exposed industrial systems remain a major risk

Cybersecurity researchers have repeatedly warned that industrial equipment used by water utilities can sometimes be found exposed online. Cybersecurity company Forescout recently identified more than 2,800 controllers associated with U.S. water systems that were accessible from the internet.

Internet exposure does not necessarily mean an attacker can immediately control a water facility. Security protections, authentication requirements and network configurations vary widely. Recent incidents, however, demonstrate that attacks on operational systems can sometimes produce real-world effects.

Iranian government-linked hackers have previously targeted U.S. critical infrastructure, often focusing on vulnerable internet-facing systems. Historically, many of those operations have been described as opportunistic, making the number and geographic spread of the latest incidents particularly significant.

Iran-linked groups have also been accused of attacks outside the water sector. Earlier this year, the U.S. government linked the hacktivist group Handala to Iran’s Ministry of Intelligence and Security after the group disrupted operations at the medical technology company Stryker. Handala later claimed responsibility for compromising the personal Gmail account of FBI Director Kash Patel.

What remains unknown about the campaign

Several important questions remain unresolved, including whether every reported water-sector incident is part of the same campaign and which Iranian organisation, if any, directly coordinated the attacks.

There is also no public accounting yet of how many utilities were successfully compromised versus those that were merely targeted. The FBI’s disclosure that incidents occurred in at least seven states establishes a broader geographic footprint than the initially reported attacks in Minnesota, but the full scope remains unclear.

The incidents nevertheless highlight a longstanding cybersecurity problem for U.S. water infrastructure: relatively small local operators can be responsible for equipment that directly affects public services while facing sophisticated threats with limited security resources.

For now, Iran remains the principal suspected state actor based on cybersecurity warnings and reported intelligence assessments, but a formal federal attribution of the nationwide campaign has yet to be made.