Iran-Linked Cyberattacks Target US Water Systems, Australian Hospitals on Alert
A series of cyberattacks on nearly 30 water systems in Minnesota this week has been attributed to a hacker group with ties to Iran, according to US media reports citing security firms and investigators. The attacks, which occurred on Sunday and Monday, temporarily disrupted water service in the town of Braham near Minneapolis for about two hours before operations were restored.
Cybersecurity firm Tenable identified the methods used in the attack as consistent with CyberAv3ngers, a group the US government accuses of operating under Tehran’s direction. While US authorities suspect Iranian involvement, formal attribution has not yet been confirmed. The incidents follow a July 22 advisory from CISA warning of ongoing threats from Iran-affiliated actors targeting US critical infrastructure, including water and wastewater systems.
The FBI has emphasized its commitment to countering such threats, with Assistant Director Brett Leatherman stating that the agency is working to "identify, disrupt, and impose costs" on those responsible. The attacks coincide with heightened tensions, as Iranian-linked hackers have previously claimed retaliation for perceived US and Israeli actions. In March, the Handala Hack group also allegedly backed by Iran targeted US medical supplier Stryker and payment platform Verifone, framing the attacks as revenge for a February airstrike in southern Iran that killed over 150 people, including many children.
Meanwhile, Australian hospitals remain on high alert after the same Iranian cyber militia breached a US multinational supplying critical medical equipment to the country. The incident underscores the growing threat of state-backed cyber operations against global infrastructure.
Stryker cybersecurity rating report: https://www.rankiteo.com/company/stryker
"id": "STR1787430281",
"linkid": "stryker",
"type": "Cyber Attack",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Utilities',
'location': 'Minnesota, USA',
'name': 'Water systems in Minnesota',
'type': 'Critical infrastructure'},
{'customers_affected': 'Australian hospitals',
'industry': 'Healthcare',
'location': 'USA, Australia',
'name': 'US multinational supplying medical equipment '
'to Australia',
'type': 'Medical supplier'},
{'industry': 'Healthcare',
'location': 'USA',
'name': 'Stryker',
'type': 'Medical supplier'},
{'industry': 'Financial Services',
'location': 'USA',
'name': 'Verifone',
'type': 'Payment platform'}],
'date_detected': '2023-11-05',
'description': 'A series of cyberattacks on nearly 30 water systems in '
'Minnesota attributed to a hacker group with ties to Iran '
'disrupted water service in the town of Braham for about two '
'hours. The attacks coincide with heightened tensions and '
'follow a CISA advisory warning of ongoing threats from '
'Iran-affiliated actors targeting US critical infrastructure. '
'Australian hospitals are also on high alert after the same '
'group breached a US multinational supplying critical medical '
'equipment.',
'impact': {'downtime': '2 hours (Braham water service)',
'operational_impact': 'Temporary disruption of water service',
'systems_affected': 'Water systems, medical equipment supplier'},
'investigation_status': 'Ongoing',
'motivation': 'Retaliation for perceived US and Israeli actions',
'references': [{'date_accessed': '2023-07-22', 'source': 'CISA advisory'},
{'source': 'Tenable'},
{'source': 'US media reports'}],
'regulatory_compliance': {'regulatory_notifications': 'CISA advisory (July '
'22)'},
'response': {'law_enforcement_notified': 'FBI, CISA',
'recovery_measures': 'Operations restored in Braham after 2 '
'hours',
'third_party_assistance': 'Tenable (cybersecurity firm)'},
'threat_actor': ['CyberAv3ngers', 'Handala Hack group'],
'title': 'Iran-Linked Cyberattacks Target US Water Systems, Australian '
'Hospitals on Alert',
'type': 'Cyberattack'}