Iranian hackers confirmed targeting water systems across seven U.S. states

The scope of a major cyberattack campaign targeting water infrastructure across America has dramatically widened. Following initial reports of compromises to over 30 Minnesota water utilities, the FBI has now confirmed that the breach extends to utilities in at least seven states, representing what may be the largest and most consequential assault on U.S. industrial control systems on record.

Attribution to Iran Confirmed#

A recently obtained memo has provided the first official documentation linking the intrusions to Iranian-affiliated actors. While authorities initially flagged Iranian involvement in earlier attacks from April, this leaked communication directly connects the same threat group to the recent wave of Minnesota utility breaches. The evidence marks a significant escalation in cross-border cyberattacks targeting American critical infrastructure, coinciding with the ongoing conflict in the Middle East.

Scope and Impact#

The FBI and Environmental Protection Agency have not disclosed which states were affected or details about the extent of the damage. However, the Cybersecurity and Infrastructure Security Agency (CISA) indicated that in multiple cases, the attackers disabled digital control systems and triggered boil-water advisories—a sign of potential contamination. The hackers targeted programmable logic controllers—the devices connecting software systems to physical equipment running water treatment facilities.

Both CISA and the FBI are urging utilities to take immediate action: isolating internet-connected controllers, strengthening password protections, and restricting access through allowlists that permit only authorized devices to connect.

Political Disputes Over Attribution#

President Trump rejected the Iranian attribution publicly, instead blaming Minnesota's Democratic governor Tim Walz. His response echoes his previous dismissal of Russian interference in the 2016 Democratic National Committee breach—a position contradicted by U.S. intelligence agencies at the time.