In brief
Last week Minnesota announced that more than 30 of its water systems had been subject to a coordinated cyber‑attack, and later the FBI warned that similar incidents were reported in seven states. U.S. authorities are examining a possible Iranian connection, though the government has not confirmed the attribution. Experts note that Iran has a record of targeting U.S. infrastructure and may use proxy groups for plausible deniability. The attacks are seen as a threat to public confidence rather than an immediate threat to water supply, yet they could lead to more destructive acts if not mitigated. Officials are urging the rapid removal of legacy systems from the internet and the implementation of stronger cyber‑security measures to safeguard the nation’s essential services.
On Thursday, the state of Minnesota reported that more than 30 of its public water systems had been hit by a coordinated cyber‑attack, surprising many in Washington. A few days later the Federal Bureau of Investigation warned that similar incidents were occurring in seven states and that some attacks had degraded water operations.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is reportedly probing for signs of an Iranian‑related operation, although it has not released any public comment. Cyber‑security specialists, speaking with the BBC, say the most likely source remains Tehran, citing a pattern of attacks that the organization has previously used to stir discord and undermine public confidence.
Former U.S. State Department anti‑terror adviser Morgan Wright explained that attacks of this type are generally attributed to Iran or North Korea. “We are currently in conflict with Iran,” he said, adding that the nation often appears as a front for groups that do the actual hacking work. Other experts warn that the claim of an Iranian link could itself be a ruse aimed at fuelling tension during the U.S. war with Iran.
Comments from the former White House Deputy National Cyber Director Jake Braun suggest that the Trump administration may be reluctant to publicly accept Iran’s involvement, even if evidence exists. A Republican cabinet meeting last week saw President Trump blame “grossly incompetent” Minnesota officials, including Governor Tim Walz, for the incident. Walz, a Democrat, countered that the President knew the true source of the attack and that other states had also been affected.
Iran has historically denied involvement in similar cyber incidents, including attacks on U.S. hospitals, presidential campaigns, and water systems. Earlier this year, the U.S. Department of Justice linked a group called Handala with several cyber‑operations allegedly working on behalf of the Iranian Ministry of Intelligence and Security.
Handala has been blamed for harming a California water facility in June and for a 2026 disruption of a medical technology firm, as well as for infiltrating U.S. election systems in 2024. These incidents illustrate a broader pattern of Iran‑linked attacks on U.S. infrastructure.
The most pressing concern is not the direct loss of water but the erosion of public trust in essential services. CNN verified that the main threat is a loss of confidence in local governments, a goal easily achieved by disrupting transparency in water supply systems. Nonetheless, experts warn that future attacks could potentially endanger water supplies by injecting harmful chemicals, shutting off pipelines, or damaging critical equipment.
The United States has more than 152,000 public drinking water systems and 16,000 wastewater treatment facilities, making the scope of any potential breach vast. CISA has advised governments to upgrade their operational technology (OT) systems and remove legacy devices from the internet as soon as possible. Failure to act could “bring a nation to its knees,” experts say, by striking not only the nation's power grid but also its water supply.
The agency recommends sweeping password changes, the isolation of systems from public networks, and periodic vulnerability tests for all water‑treatment and distribution entries. Those steps are presented as a first line of defense to mitigate further attacks and protect the nation's vital infrastructure.
