Water systems in at least seven US states faced cyberattacks linked to Iran. The attacks hit multiple utilities and caused real problems. In Minnesota alone, more than 30 municipal water and wastewater facilities were targeted in the week before August 1, 2026.
The incidents happened mainly on July 26 and 27. The attacks caused water pressure loss and flooding in some areas. Hackers gained remote access to devices called Programmable Logic Controllers, or PLCs. These devices control important water operations.
The hackers changed IP addresses and passwords on these internet-connected devices. This allowed them to disrupt water flows and damage equipment. The Minnesota state IT agency confirmed that the attackers monitored and controlled equipment remotely during the incidents.
Warnings and Responses
The FBI and EPA issued a public announcement about these attacks. They warned that utilities in no fewer than seven states were affected. The US Cybersecurity and Infrastructure Security Agency, or CISA, had already warned back in April 2026. They said Iranian-affiliated hackers were targeting water infrastructure.
In April, CISA noted attackers focused on internet-connected operational devices. Some of these devices were made by Rockwell Automation. By July, CISA updated its advisory to include devices from other manufacturers too. The agency advised utility companies to use secure gateways, firewalls, stronger passwords, and access control lists to protect systems.
Official Reactions
Minnesota Governor Tim Walz said he knows who was behind the attacks. He also confirmed other states were hit. “Trump knows exactly who is responsible for this attack, and knows that other states were hit too,” Walz said.
John Israel, Minnesota’s chief information security officer, said the state has shared relevant information with the federal government. The government is evaluating the activity and trying to identify the specific threat actor.
However, President Donald Trump blamed Minnesota’s government for the attacks. He called the state “grossly incompetent” and dismissed the idea that Iran was responsible. “They blamed it on Iran. I don’t think so. I think I blame it on Minnesota because they’re grossly incompetent,” Trump said. He added, “Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota.”
Why This Matters
The US has about 152,000 public drinking water systems and over 16,000 wastewater treatment systems. These systems are vulnerable to cyber threats because many rely on internet-connected devices. If hackers disrupt water systems, it risks public health and safety.
Water utilities are critical infrastructure. Attacks on them can cause pressure loss, supply interruptions, and even flooding. The recent attacks show the need for better cybersecurity in these systems. Experts advise companies to tighten security to prevent future incidents.
As cyber threats grow, protecting water infrastructure is a national priority. Officials continue to track these attacks closely. They want to stop hackers before they can cause more damage.
Based on
- 7 States’ Water Systems Hit by Cyberattacks Likely Tied to Iran — wired.com
- Cyberattacks Hit Water Facilities In Seven States Across The US — engadget.com
- A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran | WIRED — wired.com
- Minnesota not Iran to blame for state’s water issues, says Trump — bbc.com
