Iran-linked cyberattack hits Minnesota water systems, FBI investigates nationwide

Federal authorities were investigating whether Iranian hackers were behind malicious cyber activity that hit Minnesota water systems and spread to at least seven states. Donald Trump said he did not believe Iran was behind the Minnesota attack, but investigators called the Iran assessment preliminary and said there were no signs that any water supply had been rendered unsafe to drink.

In Minnesota alone, technology at more than 30 community water systems was affected, and some utilities switched to manual operations as operators tried to keep water service running. Minnesota IT officials had disclosed a coordinated cyberattack on more than 30 local water utilities on July 28, and some systems were shut down altogether.

The FBI said municipal water systems in seven states were targeted that week, and the footprint had widened by Aug. 1 to include Michigan and Georgia. Sources told ABC News that at least a dozen states were reporting hacks, turning what began as a Minnesota disruption into a multi-state incident with local utilities at the center.

The episode fit a warning federal cyber defense officials had already been sounding. In December 2023, the Cybersecurity and Infrastructure Security Agency warned that IRGC-affiliated cyber actors were exploiting programmable logic controllers, or PLCs, in multiple sectors including U.S. water and wastewater facilities. In April 2026, federal agencies updated those warnings to say Iranian-affiliated cyber actors were exploiting internet-facing PLCs across American critical infrastructure.

An FBI and Environmental Protection Agency alert also warned of “malicious cyber actors” remotely tampering with water systems and said critical infrastructure in the United States could be at risk. That is the practical vulnerability now under scrutiny: small, locally run water systems can depend on exposed control equipment, remote access, and limited staff, so a breach can force a quick switch from digital oversight to manual workarounds.

For residents, the most immediate signal has been service disruption, not contamination. For municipal operators, the Minnesota breach showed how quickly a local utility can become part of a national-security investigation, with manual operations, shutdowns, and federal forensic work all unfolding at once.