US probes possible Iranian involvement in water system cyber-attacks across seven states
Federal agencies are investigating coordinated cyber-attacks on water utilities in Minnesota and six other states, with some officials suggesting Iran may be behind the incidents, though the administration has not formally attributed blame.
The Cybersecurity and Infrastructure Security Agency (CISA) is investigating a series of coordinated cyber-attacks that disrupted water operations in Minnesota and six additional states, according to federal officials. The FBI has warned that the activity degraded water services in those locations.
Former State Department anti-terror adviser Morgan Wright told the BBC that such attacks are often linked to Iran or North Korea, noting that Iran is currently a primary adversary for the United States. "And who are we in conflict with right now? Well, it's Iran. So they become, they go to the top of the listed terms of nations capable, and also having a desire to do something like this," he said.
Former acting White House Deputy National Cyber Director Jake Braun said the Trump administration might be reluctant to acknowledge Iranian involvement because of its own information-war strategy. "They're attacking our trust in our government to be able to deliver basic services in a time when, you know, you've got a deeply divided country over the war," Braun added.
President Donald Trump blamed "grossly incompetent" Minnesota officials for the hack, while Governor Tim Walz countered that the president knows who is responsible and that other states were also affected.
Iran has not commented on the recent incidents and has historically denied involvement in similar cyber-operations. A spokesperson for Iran's foreign ministry previously said the United States should provide proof of any accusations.
Experts said the attacks pose a greater risk to public confidence than to the physical water supply, but warned that more sophisticated intrusions could potentially disrupt water treatment processes or cause chemical contamination. CISA and the Environmental Protection Agency have described cyber threats to water utilities as a serious concern, noting the United States operates over 152,000 public drinking water systems and 16,000 wastewater facilities.
To mitigate risk, officials recommend removing vulnerable control systems from internet access and resetting passwords, while emphasizing the need for broader upgrades to outdated infrastructure.