Authorities in the United States are investigating a series of coordinated cyber-attacks targeting water systems in seven states, with the US Cybersecurity and Infrastructure Security Agency (CISA) exploring potential links to Iran.

Last week, Minnesota disclosed that over 30 of its water systems had been compromised in a coordinated cyber assault. Subsequently, the FBI confirmed similar incidents in six other states, reporting disruptions that affected water operations.

Suspected Iranian Involvement

While no official attribution has been made, cyber experts and US media reports suggest Iran as a likely perpetrator. Morgan Wright, a former US State Department anti-terror adviser, noted that Iran is among the few nations with both motive and capability to carry out such attacks, especially amid ongoing geopolitical tensions.

There are also considerations that hackers may have used Iran-based digital footprints as a false flag to exacerbate discord amid US-Iran conflicts. The Trump administration has refrained from explicitly blaming Iran, instead criticizing local Minnesota officials for alleged negligence.

History of Iranian Cyber Activities

Iran has a documented record of cyber operations targeting US infrastructure and institutions, often conducted by groups such as Handala, linked to Iran's Ministry of Intelligence and Security. Notable incidents include:

  • 2026: Disrupted hacking targeting a medical technology firm and Israeli officials.
  • 2024: Attempts to interfere with US presidential campaigns.
  • 2023-2024: Attacks on US water and wastewater systems, including equipment shutdowns in Pennsylvania.
  • 2020: Efforts to access confidential voter information and influence election outcomes.
  • 2017: Ransomware campaigns against local governments and critical sectors.

Potential Risks and Response

Experts warn that while immediate risks to water supply safety are limited, the attacks undermine public trust in essential services. There remains a possibility that future intrusions could cause physical harm by manipulating water treatment processes.

CISA and the US Environmental Protection Agency have emphasized the seriousness of cyber threats to water utilities, urging upgrades to infrastructure security. Recommendations include disconnecting water systems from the internet and enforcing strong password protocols.

Given that most US water utilities are publicly managed, the responsibility to enhance cybersecurity falls largely on government agencies to prevent further breaches.