FBI probes suspected Iranian cyberattack on Minnesota water systems

Officials said there had been no disruption to water delivery and no reports of water contamination.

By Vered Weiss, World Israel News

U.S. intelligence agencies and the FBI are investigating a coordinated cyberattack targeting the operational technology of more than 30 municipal water systems in Minnesota, with officials suspecting Iranian-backed hackers while cautioning that the assessment remains preliminary.

The breach was first detected on Sunday and involved programmable logic controllers (PLCs), computers used to remotely monitor and operate equipment including water towers and treatment plants.

According to the Cybersecurity and Infrastructure Security Agency (CISA), the attackers sought to alter system settings and change passwords, preventing operators from accessing the automated controls.

The affected systems were switched to manual operations after the attempted intrusions. Although boil water notices were issued, officials said there had been no disruption to water delivery and no reports of water contamination.

Investigators said their assessment could change as additional evidence is collected.

The investigation comes during the U.S.-Israel war in Iran and as intermittent negotiations continue in an effort to halt the ongoing exchange of strikes across the region.

Communities affected by the cyberattack included Plymouth, South St. Paul, Maple Plain and Braham. Some municipalities declared local emergencies or introduced temporary water conservation measures while state and local information technology teams worked to contain the incident.

Officials said the affected facilities were isolated from the intrusions, and normal communications with the water systems had been restored by the middle of the week.

Following the attacks, CISA issued a nationwide alert warning water and wastewater utilities of a significant increase in threat actors targeting programmable logic controllers and changing passwords to lock operators out of their systems.

The agency said hackers have increasingly focused on automated control systems used to manage critical infrastructure.

According to Minnesota’s state information technology agency, water utility equipment was remotely monitored and controlled during attacks on July 26 and July 27.

The investigation remains ongoing as federal authorities work to determine responsibility for the coordinated intrusions.

While officials suspect Iranian-backed hackers were behind the attacks, they emphasized that the attribution remains preliminary as investigators continue gathering additional data.