ع
Minnesota authorities reported last week that more than 30 of the state’s water systems had come under a coordinated cyber attack, prompting the FBI to warn that similar activity had struck facilities in seven states total with some incidents degrading water operations. The Cybersecurity and Infrastructure Security Agency has joined the inquiry into a possible Iranian connection, although the agency declined to comment publicly on the matter according to multiple US media accounts. A CNN report detailed how a memo from the Minnesota Bureau of Criminal Apprehension described the hackers’ apparent aim as causing loss of system pressure that could lead to water contamination.
Cybersecurity analysts have pointed to Iran’s history of targeting critical infrastructure as they assess the latest incidents, with former State Department adviser Morgan Wright telling the BBC that such attacks typically trace to actors in Iran or North Korea amid current US-Iran tensions. The US Justice Department has previously linked the hacker group Handala to Iran’s Ministry of Intelligence and Security, a connection noted in federal disruptions of the group’s operations earlier in 2026. Investigators are also considering whether the hackers falsely posed as Iran-based to inflame divisions during ongoing conflicts, according to CBS News reporting cited in broader coverage.
President Donald Trump used a cabinet meeting on July 31 to fault Minnesota officials including Democratic Governor Tim Walz for the state’s water system vulnerabilities, calling the leadership grossly incompetent. Walz countered that Trump knows exactly who bears responsibility and is aware that multiple other states faced similar attacks. Iran has not issued a statement on the current events but has denied involvement in past cyber campaigns, including a 2016 case targeting a New York dam and financial institutions where a foreign ministry spokesman insisted the US provide proof of any accusations.
The pattern aligns with documented Iranian-linked activity against US water utilities, as a 2023 Cybersecurity and Infrastructure Security Agency advisory attributed hacks on Pennsylvania water and wastewater systems to actors affiliated with the Islamic Revolutionary Guard Corps that temporarily disrupted pressure-regulating equipment. In June 2026 an Iran-linked group known as Handala claimed responsibility for breaching California Water Service systems serving Bakersfield, Visalia and Chico, leaking customer billing data while stating it had deliberately avoided operational disruption, according to reports from Cybersecurity Dive and SJV Water. California Water Service confirmed at the time that no production or delivery systems were compromised even as the group posted screenshots of resident bills.
Experts have emphasized that the immediate risk from these intrusions centers on eroding public confidence in water security rather than immediate supply failures, although malicious actors could eventually manipulate chemical dosing, shut off flows or damage equipment. The United States maintains 152,000 public drinking water systems and more than 16,000 wastewater treatment facilities, many of which rely on aging infrastructure vulnerable to remote access according to joint assessments from the Cybersecurity and Infrastructure Security Agency and the Environmental Protection Agency. Jake Braun, a former acting White House deputy national cyber director, told the BBC that such operations exploit a politically divided environment to undermine trust in government services.
The Cybersecurity and Infrastructure Security Agency has urged water utilities to disconnect operational technology from the internet where possible, reset all passwords and accelerate modernization of legacy systems to counter persistent threats from state-linked actors. Many of these facilities are publicly operated, placing the burden on government bodies to fund and implement the recommended upgrades across thousands of sites. Federal advisories from 2026 specifically warned of Iranian interest in programmable logic controllers used throughout the water sector, building on earlier alerts that highlighted the national security implications of compromised utilities.
