A coordinated cyberattack targeted more than 30 municipal water facilities across Minnesota, prompting an ongoing investigation by U.S. cybersecurity and law enforcement agencies. The Minnesota Information Technology (MNIT) agency reported that the attacks occurred on Sunday and Monday, focusing on programmable logic controllers (PLCs) and human-machine interfaces (HMIs), critical components used to monitor and control water systems.

MNIT is coordinating its investigation with federal agencies including the Cybersecurity and Infrastructure Security Agency (CISA), the Environmental Protection Agency (EPA), and the Federal Bureau of Investigation (FBI). Minnesota’s Chief Information Security Officer John Israel stated that the state has provided information to federal agencies, which are "evaluating this activity in the broader national context."

The FBI’s Cyber Division Assistant Director Brett Leatherman noted in an advisory that Iranian actors "continue to target U.S. critical infrastructure" and disrupt essential services Americans rely on. This follows a July 22 advisory from CISA, the FBI, and other federal agencies warning that Iranian hackers have been targeting PLC systems in water and wastewater sectors.

National Center for Open and Unsolved Cases founder Morgan Wright expressed "at least moderate confidence" that Iran is behind the attacks, citing a prior alert predicting such an attack.

The FBI released a public service announcement stating that water and wastewater utilities in at least seven states have reported cyberattack incidents, some of which degraded water operations, leading some utilities to switch to manual operations.

However, former President Trump dismissed Iranian involvement during a Cabinet meeting at Camp David, Maryland, blaming Minnesota officials for being "grossly incompetent" and criticizing the state's governor. Minnesota Governor Walz responded by accusing Trump of focusing more on political attacks than addressing the cyber threat.

Officials have not definitively attributed the attacks to a specific actor, and the investigation is ongoing. Authorities are also considering whether the attacks were designed to appear Iran-based amid the ongoing U.S.-Iran conflict.

Sources