RESOLVING THE LEDGER
This is one outlet's own report from Time — the article as it was filed. Other outlets are covering the same event; open the full story to compare every source side by side.
See the full story · 5 sources
A cyberattack targeted the operating technology at over 30 water systems in Minnesota last week, including Plymouth's, state officials said. —Ellen Schmidt—AP
Malicious cyber activity has affected technology at water systems in at least seven states last week, forcing some facilities to switch to manual operations and prompting the FBI and Environmental Protection Agency (EPA) to warn facilities nationwide of hackers.
Minnesota IT Services said in a statement last week that at least 30 municipal water facilities were targeted July 26-27 and that it had “immediately activated the state's cybersecurity incident response capabilities.” Over the weekend, Michigan also reported cyberattacks on nine of its water systems.
Without confirming just how widespread the attacks may have been or which states they affected, the FBI and EPA said in a joint statement that multiple incidents had occurred. It explained that hackers are remotely accessing internet-connected controls, changing administrator passwords, and “causing operational disruption” like flooding and pressure loss, which “could potentially allow untreated ground water to seep into pipes.”
The incidents also came days after federal agencies updated a warning about ongoing Iranian cyber threats targeting U.S. critical infrastructure, though investigators have not publicly linked the latest attacks to Tehran.
United States water systems are a part of critical infrastructure in the country, which makes them attractive targets for cyberattacks. The EPA has warned in recent years that a significant number of local water systems had critical or high-risk vulnerabilities, including “outdated software, poor network security, weak access controls, and a lack of employee cybersecurity training.”
But it has also indicated that it’s up to individual operators to protect their own systems from external threats. An EPA spokesperson pointed TIME to Administrator Lee Zeldin’s comments on FOX on Saturday, where he called on utility operators and local entities to protect themselves.
“There is a lot of individual responsibility on the part of companies and local water systems and infrastructure and local municipalities and state governments,” he said.
“Even water organizations with mature cybersecurity processes should validate their external connections,” the Cybersecurity and Infrastructure Security Agency (CISA) said in an alert issued last week. It outlined several mitigations, including adding extra layers of password security and disconnecting key systems from the internet.
In practice, this responsibility is split between local utility operators and federal oversight bodies, with funding coming from both federal allocations and municipal budgets, making cybersecurity upgrades difficult to coordinate.
And vulnerabilities may be present within water systems of all sizes, CISA said in its alert, which further noted that the agency was “observing a significant increase in cyber threat actors.”
But the impact of the latest round of attacks has been limited, according to state officials. The attacks primarily resulted in an interruption of service at the facilities, rather than putting Americans at risk by means such as exposing their drinking water to contamination.
Dale George, the director of communications for Michigan’s Department of Environment, Great Lakes and Energy, said in a statement Saturday that “all systems continued to operate safely.”
Federal agencies are investigating who might be behind the latest attacks.
“The FBI and our interagency partners are fully engaged to protect critical infrastructure and we remain well-equipped to protect against cyber threats of all varieties,” the FBI said in a statement to TIME .
“Cybersecurity threats are a serious concern for our nation’s water infrastructure, including the communities, businesses, hospitals, schools, and other critical infrastructure sectors that rely on these critical lifeline services,” EPA Assistant Administrator for Water Jess Kramer said in an advisory released by CISA in April.
The advisory, which warns about Iranian cyberattacks targeting the internet-connected systems commonly used to operate pumps, motors, and valves, was updated on July 22—just days before the latest attacks on U.S. water systems.
Could Iran be connected to the attacks?
The FBI, EPA and CISA put out a joint statement last week to accompany the advisory updates. It warned of “ongoing Iranian-affiliated cyber activity” targeting critical U.S. infrastructure, including “Water and Wastewater Systems, Energy and Government Services and Facilities, to include local municipalities.”
When water systems were attacked in the following days, it quickly drew attention to the possibility of Iranian involvement—especially in light of the similarity to an incident from 2023, involving a cyberattack on a municipal water facility in Pittsburgh, Pennsylvania. CISA attributed it to a group called CyberAv3ngers, which is affiliated with the Islamic Revolutionary Guard Corps.
"If a hack like this can happen here in Western Pennsylvania, it can happen elsewhere in the United States," lawmakers wrote in a letter to the Attorney General.
The latest attacks also come at a moment when Iran has both an apparent motive and well-established cyber capabilities.
They took place amid escalating tensions between the U.S. and Iran, marked by near-daily strikes and an ongoing standoff over control of the Strait of Hormuz.
When asked about potential Iranian involvement, President Donald Trump dismissed the suggestions and instead, without offering evidence, blamed Minnesota.
"You know who's behind it? Minnesota. Because they're grossly incompetent,” Trump said during a televised Cabinet meeting at Camp David on July 31. “I think the governor's behind it. I don't think there was an Iranian cyberattack. I think that Minnesota ought to get its act together."
He continued, “They like to say, 'Oh, it was Iran.' Iran shoul...
AIPROPX is an independent multi-source news index — we track, compare, and connect coverage from across the web into one place you won't find anywhere else.