Since late July 2026, water and wastewater systems in seven US states have faced serious cyberattacks. These attacks hit seven utility companies and more than 30 municipal water facilities in Minnesota alone. The FBI reports victims experienced flooding and loss of water pressure as a direct result.
The attacks began around July 27, 2026. Hackers accessed systems remotely by targeting Programmable Logic Controllers (PLCs). These devices help control water flow and pressure. By changing IP addresses and passwords, the hackers took control of the equipment.
More than 30 water systems in Minnesota were hit in a wave of attacks over a single week. One targeted city was Plymouth, a community of about 80,000 people located roughly 70 miles north of Minneapolis. These cyber intrusions caused real disruption, flooding parts of the system and dropping water pressure.
Iran-Linked Cyber Threats to Water Infrastructure
US officials have connected these attacks to Iran. The Water Information Sharing and Analysis Center (WaterISAC) said the malicious activity in Minnesota matches a hacking campaign previously described by the US Cybersecurity and Infrastructure Security Agency (CISA). CISA warned back in April that Iran-affiliated hackers were targeting water infrastructure.
A memo obtained by WIRED tied dozens of attacks on Minnesota’s water and wastewater utilities directly to Iran. Experts say Iran has geopolitical motives and a history of targeting water systems. Cynthia Kaiser, former FBI cyber deputy assistant director, highlighted Iran’s recent focus on similar infrastructure.
These attacks came just days after US officials warned publicly about Iran-backed hackers focusing on critical infrastructure. The FBI and Environmental Protection Agency have advised utility companies to strengthen defenses. Recommendations include using secure gateways and firewalls, setting stronger passwords, and applying access control lists.
Government Response and Challenges
The FBI continues to investigate. They emphasize that attribution requires careful analysis of technical and intelligence evidence. Minnesota’s IT services agency and federal partners are working together to respond.
Cybersecurity expert Bryson Bort stressed the threat’s seriousness: “We need to be prepared. Attacks like this illustrate that there are folks who mean the U.S. harm today.”
However, not all officials agree on the source. President Donald Trump dismissed the accusations, saying, “Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota.” Minnesota’s governor pushed back, stating Trump “knows exactly who is responsible for this attack, and knows that other states were hit too.”
These attacks show how vulnerable critical water systems remain. As hackers grow more skilled, the risk to communities’ safety and health rises. Defending water infrastructure from cyber threats will require ongoing vigilance and better security tools.
Based on
- Cyberattacks hit water facilities in seven states across the US — engadget.com
- Hackers targeted municipal water systems in 7 states this week, FBI says — nbcnews.com
- Cyberattacks on Minnesota water systems investigated as officials warn about Iranian hackers | The Independent — independent.co.uk
- 7 States’ Water Systems Hit by Cyberattacks Likely Tied to Iran | WIRED — wired.com
