FBI and EPA warn of cyberattacks on municipal water systems in seven states

The FBI and the Environmental Protection Agency issued a public service announcement on Thursday warning that municipal water and wastewater utilities in at least seven states have experienced cyber incidents that disrupted operations. While the agencies did not identify the states, they said the attacks targeted specific brands of control systems and involved remote access to internet-facing devices, changes to IP addresses and passwords, and loss of monitoring capabilities.

A law-enforcement official said the recent intrusion of more than 30 water facilities in Minnesota bore hallmarks of Iranian-linked activity, though no definitive attribution has been made. Minnesota’s information technology services agency later said there was no evidence that any water supply had been contaminated.

The advisory recommends that operators remove programmable logic controllers from direct internet exposure, place them behind secure gateways and firewalls, employ strong passwords and limit device communications through access-control lists. "Attribution requires careful analysis of technical evidence alongside broader national and international threat intelligence, and our federal partners are best positioned to lead that work," said Emily Zimmer, a spokesperson for Minnesota’s IT agency.

The warning follows earlier alerts from the Cybersecurity and Infrastructure Security Agency and other federal bodies about Iran-backed hackers targeting critical infrastructure amid heightened tensions between the United States and Iran.