US investigators are examining whether Iran was behind a coordinated cyberattack on more than 30 community water systems in Minnesota, a case now folded into Iran–USA relations. Minnesota IT Services said investigators found malicious activity involving a system's technology after attacks on 26 July and 27 July.
The probe matters because CISA says hackers are targeting water and wastewater systems, including automated computers known as PLCs, and changing passwords to lock out operators. The US has 152,000 public drinking water systems and more than 16,000 wastewater treatment systems.
John Israel and Minnesota IT Services
John Israel, Minnesota's chief information security officer, said, “We have provided relevant information to the federal government, which is evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor.” Minnesota IT Services also said not all communities were impacted by a disruption of services.
That split matters for affected systems: some were pushed into manual operation, while others were hit at the technology layer without losing service. Boil water notices were issued after the attack, showing that the response moved beyond digital monitoring into public-safety handling at the local level.
CISA and PLC targeting
CISA is warning of a significant increase in hackers targeting water and wastewater systems. In April, CISA warned that Iranian-affiliated hackers were attacking internet-connected operational devices, including PLCs made by Rockwell Automation, and CISA updated that advisory earlier this month to include devices made by other companies.
Hackers have been targeting those PLCs and changing passwords to lock out operators, which leaves utilities relying on manual control until access is restored. The contacted CISA, which would not confirm the reports about Iran's possible connection to the Minnesota attacks.
Iran attribution remains preliminary
US investigators cautioned that the assessment was preliminary and could change as more data was collected. The council said there was no evidence that any data was accessed or stolen in the 17 July attack, which keeps the current focus on system access, operator lockout, and whether the intrusion can be tied to a specific actor.
For Minnesota communities, the immediate issue is not only whether service stayed up, but whether the water systems can be returned to normal control without another lockout. For the federal side, the next step is attribution work inside the broader US warning set around water and wastewater systems.
