Several states report cyberattacks as spy agencies suspect Iran is targeting water

Federal authorities are warning that critical infrastructure systems in the United States could be at risk after at least seven states reported cyberattacks that interrupted their water or wastewater operations last week.

According to a joint alert from the FBI and the Environmental Protection Agency, “malicious cyber actors” have been remotely tampering with some water systems’ internet-connected programmable logic controllers, or PLCs, causing loss of water pressure and flooding.

The warning, issued Thursday, comes after U.S. intelligence officials said Iran was likely behind a coordinated cyberattack on more than 30 municipal water systems in Minnesota. Experts have also warned for years that the U.S. water industry, which has resisted regulation efforts, has been vulnerable to cyberattacks.

Intelligence agencies have not definitively concluded that Tehran was responsible for the disruptions in Minnesota, but the hack follows urgent warnings by federal cybersecurity officials that Iran for months has been targeting internet-exposed devices that control operations at water, wastewater, and energy facilities in the U.S. In July, federal cybersecurity authorities specifically warned that Iranian hackers were exploiting vulnerable PLCs.

President Donald Trump has blamed Minnesota’s government, not Iran, for that attack. The FBI did not respond to a request for comment Friday about whether it believed Iran was responsible, saying the agency and others were “fully engaged to protect critical infrastructure.”

The Post reported Thursday that intrusions have been noted at several water and energy systems across the country since shortly after the war began on Feb. 28.

Federal authorities have not identified which states were affected in recent hacks. Outside of Minnesota, Michigan and South Dakota have also reported attacks. However, experts said it is likely many more states are affected, given that the brand of PLCs targeted — Rockwell Automation/Allen-Bradley — is widely used.

“We only have one internet and it’s the same equipment for all these victims. ... Theoretically, you should see these [vulnerabilities] in all 50 states,” said Joshua Corman, a public safety and resilience expert at the Institute for Security and Technology.

To date, the cyber attackers have employed “low sophisticated tactics” to hack into internet-connected PLCs, often ones with weak or nonexistent credentials, according to Alec Davison, an analyst with WaterISAC, an information sharing program with the government intended to strengthen security. The hackers have subsequently modified passwords to lock out operators and disconnect controllers, he said in an email.

“This has led to boil water notices and forced utilities into sustained manual operations,” Davison wrote.

The risk is that cyberattackers tampering with PLCs could change the “logic” or software of a system so that an operator might not detect an issue with, say, dangerous levels of chemicals.

A July 22 advisory issued by the Homeland Security Department’s Cybersecurity and Infrastructure Security Agency noted that the FBI and CISA have observed Iranian hackers tampering with the PLC’s logic software, “allowing systems to enter unsafe conditions without notifying operators of the anomalies.”

“Operators see normal displays. No alerts fire and the process can enter an unsafe condition without anyone knowing,” said Kurt Gaudette, head of intelligence for Dragos, a cybersecurity firm that specializes in protecting critical infrastructure.

Experts widely agreed that water infrastructure in the United States has been uniquely vulnerable for more than a decade. Of the roughly 151,000 water plants in the United States, about one-third service residential communities year-round. But only about 420 water plants participate in WaterISAC to try to improve cybersecurity across the water sector.

“We have under half a percent paying attention to cybersecurity,” Corman said. “U.S. water is incredibly prone. We’ve been prey, we just didn’t have predators with an appetite for water, but that’s over.”

Another issue is that many small- and medium-size utilities are using third-party integrators or contractors to configure the security settings on their systems, and these contractors are using default credentials and weak passwords.

Compounding the problem, the water industry has also resisted efforts to be regulated for cybersecurity. After the Biden administration tried to impose cybersecurity audits of water utilities in 2023, some water industry groups and three states — Missouri, Arkansas, and Iowa — sued, causing the EPA to roll back its standards.

Nate George, the mayor of Braham, Minn., which experienced a hack last week that caused the town’s plant to briefly go offline, said in a statement on Saturday to the Washington Post that cities such as his need more resources to comply with mandates to ensure their utility systems and infrastructure are safe.

“I would actually argue it falls mostly on states that mandate local governments make certain upgrades to their utility systems or other infrastructure but fail to provide the funding to pay for it or maintain it,” said George, a Republican running for state auditor in Minnesota.

Cybersecurity threats to the water sector, however, are only expanding.

Trump, at a meeting with cabinet officials at Camp David on Friday, waved off the suggestion that Iran was involved in the Minnesota attack — and in turn blamed its officials, a frequent political target.

“I blame it on Minnesota because they’re grossly incompetent,” Trump said at the cabinet meeting. “I would blame it on Minnesota and the governor, the corrupt governor of Minnesota. Iran’s got bigger problems than worrying about Minnesota.”

Gov. Tim Walz (D) pointed the finger at Iran as well as at Trump.

“Trump knows exactly who is responsible for this attack, and knows that other states were hit too,” Walz wrote on X. “This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran.”