U.S. investigates Iran ties to Minnesota water system cyberattack

Minnesota officials said more than 30 community water systems were targeted on July 26 and July 27 in what state authorities described as a coordinated cyberattack, pushing the incident from a local disruption into a national test of how fragile small utility controls can be.

The attacks affected operational technology used by community water utilities, the machinery that runs pumps, treatment equipment and other basic functions inside water systems. KSTP reported no ransom demand was made, and Reuters and the Associated Press said investigators saw no indication that any water supply had been rendered unsafe to drink.

Investigators are now looking into whether Iran, or hackers associated with Iran, were behind the operation, a preliminary assessment that could affect how the federal government responds. FOX 9 said the attack touched water systems across Minnesota, with later coverage naming communities including Braham, Plymouth, South St. Paul and Maple Plain.

The case landed in a sector federal agencies have already warned is exposed. On April 7, EPA, FBI, CISA and NSA issued a joint cybersecurity advisory on Iranian-affiliated cyber attacks against water systems, urging operators to harden their defenses. CISA also issued an advisory on April 7 focused on Iranian-affiliated cyber actors exploiting programmable logic controllers, the industrial devices that control physical processes in water and wastewater plants. A separate CISA advisory on Dec. 1, 2023 warned that IRGC-affiliated cyber actors were exploiting PLCs in multiple sectors, including U.S. water and wastewater facilities.

Those warnings map closely onto the vulnerabilities that define many local utilities. In testimony cited in the Senate environment record, the water sector was described as one of the most cyber-vulnerable critical infrastructure sectors because of under-resourcing, especially in small and medium systems, legacy OT systems and persistent exposure of remote access pathways. For many communities, the weakest point is not a data center but a municipal control room running aging digital equipment with limited cybersecurity staff.

If the Minnesota case is ultimately tied to Iran, federal attention would likely intensify around threat sharing, incident response and pressure on utilities to isolate operational networks, review remote access and patch PLC exposure. Reuters reported on March 20, 2024 that U.S. officials were already warning that hackers were carrying out disruptive attacks on water systems, and this episode shows how quickly those warnings can reach a town’s most basic services.