Cyberattacks Hit Water Systems Across At Least Seven US States as Iran Link Investigated

Federal authorities are investigating a widening series of cyberattacks against water and wastewater utilities after incidents in at least seven US states disrupted equipment used to monitor and control essential services.

The FBI and Environmental Protection Agency issued a national warning on 30 July after utilities began reporting unauthorised access to internet connected operational technology. Some attacks caused water pressure losses, flooding and a temporary loss of control over equipment, although authorities have not reported any confirmed contamination or serious public health consequences.

The attackers focused on programmable logic controllers, commonly known as PLCs, manufactured by Rockwell Automation under its Allen-Bradley brand. The affected devices included MicroLogix 1100 and 1400 controllers, which can be used to operate pumps, valves, treatment equipment and other physical infrastructure.

According to the federal alert, attackers remotely accessed exposed controllers before changing their internet addresses and setting new passwords. Those modifications prevented some plant operators from viewing equipment or controlling connected systems. Investigators also found discrepancies in the software instructions running on controllers at several locations, suggesting at least one victim’s operational programming had been altered.

The national investigation followed a coordinated attack against more than 30 community water systems in Minnesota on 26 and 27 July. Minnesota IT Services activated its statewide incident response operation, bringing together health, environmental, law enforcement and cybersecurity agencies to help local utilities contain and investigate the intrusions.

Most of the confirmed Minnesota incidents involved technology used to monitor and control water infrastructure remotely. State officials said evidence of an attack did not necessarily mean a community’s water supply had been interrupted, and no widespread water quality problem was identified.

The city of Braham temporarily asked its approximately 1,700 residents to conserve water after attackers disabled operating controls for its well and treatment plant. Water stored in the city’s tower continued to supply customers while operators restored the facility, and officials reported no effect on drinking water safety.

Plymouth also experienced a temporary communications failure affecting its water infrastructure, although workers retained the ability to operate the system and reported no change to water levels or quality.

Michigan became the second state to publicly identify affected utilities, reporting suspicious activity at nine water systems. State officials said local operators addressed the problems and that all nine systems continued operating safely, with no known threat to public health. Federal authorities have not disclosed the identities of the other affected states.

While the techniques used in the latest attacks appear relatively simple, their potential consequences extend beyond temporary outages. PLCs directly control physical processes, meaning an attacker who alters their programming may be able to change pressure, interrupt pumping, manipulate treatment equipment or interfere with safety functions.

A pressure loss can create conditions in which untreated groundwater enters distribution pipes. Utilities may then need to issue precautionary boil water notices until testing confirms the supply remains safe. Operators at some affected facilities were also forced to switch to sustained manual control after losing access to automated systems.

The greatest concern is that attackers could modify both the equipment’s operating instructions and the information shown to employees. That could allow a process to move into unsafe conditions while control room displays continue presenting apparently normal readings.

US cybersecurity agencies had already warned that Iranian affiliated groups were targeting internet connected PLCs across the water, energy and government sectors. An advisory first issued in April and expanded on 22 July identified attacks against equipment produced by Rockwell Automation, Schneider Electric and Siemens, as well as potentially other manufacturers. The agencies assessed that the campaign was intended to cause disruption inside the United States.

Investigators have identified similarities between that campaign and the attacks in Minnesota, including the types of equipment targeted and the methods used to reach them. US officials are examining whether Iranian linked hackers were responsible, but neither the FBI nor any state or federal agency has formally attributed the latest wave of incidents to Tehran.

Iranian hackers have previously demonstrated an interest in American water infrastructure. In 2016, the US Justice Department charged several Iranian nationals over an intrusion involving the control system of a small dam near New York City. The latest incidents suggest that internet exposed controllers remain an attractive target because they can provide a direct path from a remote computer to physical machinery.

The investigation has also become politically contentious. President Donald Trump dismissed suggestions that Iran was involved and instead blamed Minnesota’s government, although he did not provide evidence or identify another suspected attacker. Minnesota Governor Tim Walz responded that the President knew the incidents extended beyond his state and criticised reductions in federal cybersecurity resources.

The attacks have renewed attention on long recognised weaknesses within the US water sector. Many community utilities operate with limited budgets, ageing equipment and small technical teams. Remote access may be configured by outside contractors, sometimes using similar network designs across several customers. A single insecure configuration can therefore expose multiple utilities to the same attack method.

Attempts to introduce stronger federal oversight have previously encountered legal and industry resistance. In 2023, the EPA withdrew a policy that would have incorporated operational technology cybersecurity into regular public water system assessments after the measure became the subject of litigation. The agency continued to encourage voluntary assessments and technical assistance, but the withdrawal left the sector without the proposed national audit requirement.

The FBI and EPA are now urging utilities to remove PLCs from direct internet exposure, place remote connections behind secure gateways and firewalls, replace default credentials, use strong and unique passwords, restrict communications to approved devices and routinely inspect controller programs for unauthorised changes.

Utilities have also been advised to practise manual operations and regularly test backup systems. That capability proved important during the latest attacks, allowing some operators to maintain services even after automated controls became inaccessible.

The immediate disruptions have so far been limited, but the incidents demonstrate how basic security weaknesses can give remote attackers access to systems controlling an essential public service. With the investigation continuing and the full list of affected states still undisclosed, federal agencies are warning utilities to assume that any publicly accessible industrial controller could become the next target.