U.S. Officials Suspect Iran Behind Minnesota Water System Cyberattack, Assessment Preliminary

U.S. and state officials believe Iran is the likely culprit behind a cyberattack targeting more than 30 Minnesota community water systems last weekend. The assessment, however, remains preliminary, and officials have not officially attributed the attack to a specific actor. Minnesota IT Services, leading the state’s response, stated that relevant information has been shared with the federal government, which is evaluating the activity in the broader national context.

The attack, which began overnight on July 26, targeted approximately 36 municipal water systems. Investigators noted that the hackers specifically focused on programmable logic controllers and human-machine interfaces—technology used to remotely monitor and control equipment in water systems. Not all affected communities experienced service disruptions, and drinking water remains safe, with no communities advised to modify water use.

Three state officials briefed on the investigation told the New York Times that the tradecraft used and the absence of a ransom demand led analysts to tentatively conclude the attack was the work of Iranian hackers. Officials also warned that hackers could be attempting to pose as Iran-based to increase tensions, though former intelligence officials said this scenario was unlikely.

The attack occurs amid renewed direct fighting between the United States and Iran in the Middle East. Since the conflict began in February, Iran has intensified its cyberattacks against the U.S. The Cybersecurity and Infrastructure Security Agency had issued a warning just days before the Minnesota attack, cautioning that Iranian-affiliated cyberactors were attempting to breach operational technology devices to disrupt critical infrastructure, including water and wastewater systems.

Minnesota was identified as one of the early detectors of this threat, but officials noted similar activity is likely occurring in other states. John Israel, Minnesota’s Chief Information Security Officer, stated that the state is working closely with federal agencies to understand the full scope of the incident.

U.S. Senator Amy Klobuchar (D-MN) has requested a briefing from the Cybersecurity and Infrastructure Security Agency on the ongoing investigation and potential involvement of foreign actors. She emphasized her commitment to ensuring state officials have the necessary resources to protect critical infrastructure and safeguard Minnesotans.

The situation underscores the growing threat of cyber warfare to essential services, raising concerns about the vulnerability of critical infrastructure to foreign interference. As the investigation continues, the focus remains on identifying the responsible party and strengthening defenses against future attacks.

Source: Read the original report