Minnesota Water Systems: US water facilities targeted by ‘malicious cyber actors’ – who’s to blame?

Cyberattacks Target U.S. Water Systems Across Multiple States

Federal authorities issued a warning last week after malicious cyber actors launched coordinated attacks on water and wastewater facilities in at least seven U.S. states. Minnesota was the hardest hit, with 30 of its water systems disrupted, leading to low-pressure water flow in homes and boil-water advisories though no contamination was reported.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) stated that the attacks exploited internet-connected systems, allowing hackers to change passwords and lock out operators. To prevent further disruptions, CISA advised utilities to take systems offline and switch to manual operations.

While officials have not publicly named a specific group, multiple government sources cited by outlets like The New York Times and Washington Post suspect Iran is behind the attacks. Tehran has reportedly intensified cyber operations against U.S. targets since the war in Gaza began, though the FBI has not formally attributed the attacks to Iran.

Former President Donald Trump blamed Minnesota’s leadership for the breaches, claiming incompetence without evidence. Minnesota Governor Tim Walz countered, calling the attacks a form of "modern warfare" and criticizing Trump’s response.

CISA had previously warned in April about Iranian-backed threats to water system controllers, updating its advisory in July with guidance on securing vulnerable infrastructure. Similar attacks have occurred in recent years, including Russian-linked breaches in Texas and Iranian-linked incidents in Pennsylvania, prompting calls for greater federal investment in critical infrastructure defense.

Industry groups, including the Operational Technology Cybersecurity Coalition, have urged Congress to extend a $1 billion state and local cybersecurity grant program set to expire in September, warning that small towns remain exposed to nation-state threats. The origins of many such attacks often remain unclear, with some groups taking credit while others operate in the shadows.

Source: https://www.theguardian.com/technology/2026/aug/04/us-cyber-attacks-water-minnesota-iran

Minnesota Department Health cybersecurity rating report: https://www.rankiteo.com/company/minnesota-department-health

"id": "MIN1785846912",
"linkid": "minnesota-department-health",
"type": "Cyber Attack",
"date": "7/2026",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"

{'affected_entities': [{'industry': 'Utilities',
                        'location': 'Minnesota, USA',
                        'name': 'Water systems in Minnesota',
                        'type': 'Water and wastewater facilities'},
                       {'industry': 'Utilities',
                        'location': 'Multiple U.S. states (at least 7)',
                        'name': 'Water systems in other states',
                        'type': 'Water and wastewater facilities'}],
 'attack_vector': 'Internet-connected systems',
 'customer_advisories': 'Boil-water advisories issued in affected areas',
 'description': 'Federal authorities issued a warning after malicious cyber '
                'actors launched coordinated attacks on water and wastewater '
                'facilities in at least seven U.S. states. The attacks '
                'exploited internet-connected systems, allowing hackers to '
                'change passwords and lock out operators. Minnesota was the '
                'hardest hit, with 30 of its water systems disrupted, leading '
                'to low-pressure water flow in homes and boil-water advisories '
                'though no contamination was reported.',
 'impact': {'operational_impact': 'Low-pressure water flow, boil-water '
                                  'advisories, manual operations required',
            'systems_affected': 'Water and wastewater facilities'},
 'initial_access_broker': {'entry_point': 'Internet-connected systems'},
 'investigation_status': 'Ongoing',
 'motivation': 'Geopolitical tensions (Gaza war)',
 'post_incident_analysis': {'corrective_actions': 'Manual operations, federal '
                                                  'grant extensions, enhanced '
                                                  'security measures',
                            'root_causes': 'Exploitation of internet-connected '
                                           'systems, lack of federal '
                                           'investment in cybersecurity'},
 'recommendations': 'Extend federal cybersecurity grant programs, secure '
                    'vulnerable infrastructure, enhance monitoring',
 'references': [{'source': 'The New York Times'},
                {'source': 'The Washington Post'},
                {'source': 'CISA Advisory'}],
 'regulatory_compliance': {'regulatory_notifications': 'CISA advisories issued '
                                                       'in April and July'},
 'response': {'containment_measures': 'Take systems offline, switch to manual '
                                      'operations'},
 'stakeholder_advisories': 'CISA guidance on securing water system controllers',
 'threat_actor': 'Suspected Iranian-backed actors',
 'title': 'Cyberattacks Target U.S. Water Systems Across Multiple States',
 'type': 'Cyberattack'}