U.S. probes possible Iranian involvement in cyberattack on Minnesota water utilities
More than 30 Minnesota water systems experienced cyber disruptions, prompting federal and state agencies to investigate whether Iranian hackers were responsible.
Malicious cyber activity this week disrupted technology at over 30 community water systems across Minnesota, forcing several utilities to switch to manual operations while investigators assess the source of the attacks. Federal agencies, including the FBI, EPA and the Cybersecurity and Infrastructure Security Agency (CISA), are examining whether the activity was carried out by Iranian hackers, though no definitive attribution has been made.
The incidents involved programmable logic controllers (PLCs) that remotely monitor and control water-treatment equipment. In some cases, loss of monitoring and control led to pressure loss and localized flooding. The FBI and EPA indicated that similar attacks have been reported in at least seven states beyond Minnesota.
"We urge critical infrastructure owners and operators to remove publicly exposed PLCs and other operational technology from the internet as soon as possible," said Nick Anderson, acting director of CISA.
Minnesota officials said no drinking-water supply has been compromised and no customer data appears to have been accessed. Mike Ernster, a public information officer for the Minnesota Department of Public Safety, noted that the state’s Fusion Center is working with municipalities and federal partners to address the issue.
Cities such as South St. Paul, Braham, and Plymouth reported brief outages that were mitigated by shifting to manual operation and isolating affected equipment. Service continuity was maintained, and water quality, pressure and delivery were not affected.
CISA warned of a broader increase in threat actors targeting PLCs in the water and wastewater sector, advising owners and operators to validate external connections, including cellular modems that may not be captured in routine scans.
Federal officials recalled that Iran-linked hackers previously accessed U.S. water facilities in 2023 by exploiting internet-connected controllers with default passwords, underscoring the ongoing risk of such vulnerabilities.