Iran suspected in cyberattacks targeting water systems across at least 7 US states

Several U.S. water and wastewater systems were hit by cyberattacks over the past week, forcing some utilities to switch to manual operations as state and federal authorities investigate who is behind the incidents.

The FBI and the U.S. Environmental Protection Agency said on Thursday that water systems in at least seven states had reported cyber incidents to federal authorities. Officials stressed there was no indication that drinking water supplies had been contaminated or disrupted.

While investigators have not reached a final conclusion, federal officials privately believe Iran remains the primary suspect, according to The New York Times. The attacks come amid heightened concerns over Tehran's cyber campaign targeting critical infrastructure in the United States and its allies.

In Minnesota alone, according to a senior law enforcement official familiar with the investigation, “more than 30 municipal water systems across Minnesota” bore “the hallmarks of Iran-backed hackers.”

State and federal authorities have emphasized that the investigation remains ongoing and that cyber investigations can take months to reach definitive conclusions.

President Donald Trump downplayed the reports on Friday:

“I think Minnesota is behind it,” Trump said. “I don’t believe there was an Iranian cyberattack.”

Minnesota Governor Tim Walz rejected the remarks, while federal officials, according to The New York Times, had privately stated that Iran remains the primary suspect.

Nate George, mayor of Braham, a small city north of Minneapolis, similarly told the Times that local and federal authorities had little doubt about who was responsible.

“We are getting bits and pieces of information from the state of Minnesota and the FBI,” he said.

While Minnesota and Michigan disclosed that multiple incidents had occurred in their states, federal officials declined to identify all of the states affected by the cyberattacks.

Former U.S. government cybersecurity contractor Alex Orleans, who specializes in tracking Iranian hacking groups, said Tehran has conducted a wide range of cyber operations against American, Israeli and other Middle Eastern targets since the war began, but that the latest attacks on U.S. water systems appeared to mark a “major escalation.”

“What is unprecedented here is that we are seeing direct, tangible effects on control systems inside critical U.S. infrastructure,” Orleans told The New York Times.

Iran has previously been accused of targeting water infrastructure. In 2020, a cyberattack on Israeli water facilities was attributed to the Iranian regime. A Western intelligence official told the Financial Times at the time that the goal of the attack was to increase chlorine levels in water supplied to Israeli households.

The Iranian regime and its proxies have significantly increased cyberattacks against Israel and other countries since the Hamas-led Oct. 7, 2023, attack.

In June 2024, Israel's then-top cyber chief, Gaby Portnoy, warned that Iranian-led cyberattacks had become a global threat rather than one directed solely at Israel.

“We have identified that Iran is attacking its allies and other countries for information extortion and damaging digital services,” Portnoy stated during the Cyberweek annual conference held at Tel Aviv University. “The information stolen from government systems is then used for Iranian cyberterrorism,” he warned.

During the Iran war in March, the FBI seized four Iranian-linked cyberwarfare domains that targeted the United States and its allies. At the time, FBI Director Kash Patel addressed the Iranian cyber threat.

"Iran thought they could hide behind fake websites and keyboard threats to terrorize Americans and silence dissidents,” Patel stated.

“We took down four of their operation's pillars and we're not done. This FBI will hunt down every actor behind these cowardly death threats and cyberattacks, and will bring the full force of American law enforcement down on them,” he pledged.

U.S. agencies also acknowledged in April that Tehran had escalated its cyberattacks against critical infrastructure during the war involving the United States and Israel.