More than 30 drinking water and wastewater systems in Minnesota were targeted in a coordinated cyberattack this week, prompting a federal investigation and renewed warnings about threats to America’s critical infrastructure.
Unlike previous attacks that affected Pennsylvania, no Pennsylvania water systems have been identified as targets in this latest campaign.
Minnesota officials said the attacks occurred over a 48-hour period and affected operational technology used to run community water systems. While some communities temporarily relied on manual operations and asked residents to conserve water, officials said there is no evidence drinking water became unsafe.
The FBI is investigating the incidents.
Although no public attribution has been made, U.S. and Minnesota officials told multiple news organizations they believe the attacks were likely carried out by Iranian hackers. At the same time, investigators cautioned that the assessment remains preliminary and have not ruled out the possibility of a “false flag” operation intended to make the attacks appear Iranian.
The attacks come just months after the EPA, FBI, Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA) and Department of Energy issued a joint advisory warning that Iran-affiliated cyber actors are actively targeting U.S. water and energy systems by exploiting internet-connected industrial control equipment.
The warning has particular relevance in Pennsylvania.
In November 2023, the Municipal Water Authority of Aliquippa in Beaver County was the victim of a cyberattack claimed by the Iran-linked group CyberAv3ngers. That intrusion affected a booster station’s programmable logic controller but did not compromise drinking water because the utility switched to manual operation.
The latest attacks in Minnesota appear to follow a similar pattern by targeting operational technology used to control water infrastructure.
President Donald Trump has recently struck an optimistic tone regarding the broader conflict with Iran, saying he believes the fighting will not resume and that U.S. officials are engaged in “good talks” with Tehran.
At the same time, federal intelligence and law enforcement agencies continue warning that Iran-affiliated hackers pose an ongoing threat to U.S. critical infrastructure, including drinking water systems, regardless of the status of diplomatic efforts.
Cybersecurity experts say the Minnesota attacks highlight the vulnerability of many local water systems, which often rely on aging industrial control equipment and have limited cybersecurity resources. Federal officials are urging utilities nationwide to remove operational technology from direct internet exposure, strengthen authentication and monitor for suspicious activity.