US authorities have identified Iranian hackers as the likely perpetrators behind recent cyber attacks targeting water infrastructure in the United States, including a disruption in the small town of Braham near Minneapolis. Approximately 30 water systems were attacked over Sunday and Monday, July 27-28, 2026, using methods consistent with the CyberAv3ngers group, which the US government alleges operates under Tehran's control.

The attacks follow similar incidents earlier this year targeting US water and health infrastructure. On July 22, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about an offensive by Iran-affiliated organizations against online control systems for US infrastructure.

Assistant Director Brett Leatherman of the FBI's Cyber Division stated, "Iranian cyber actors continue to target US critical infrastructure, and the FBI is committed to identifying, disrupting, and imposing costs on those responsible."

In a related development, the Handala Hack group, also linked to the Iranian government, claimed responsibility in March 2026 for cyber attacks on two US companies: medical equipment supplier Stryker and digital payments platform Verifone.

The operation disrupted water supply in Braham for about two hours before service was restored. These attacks underscore ongoing cybersecurity threats to critical US infrastructure.

Separately, an internal US military investigation revealed by the New York Times found that a strike killing more than 150 people resulted from incorrect targeting coordinates used against an adjacent military base.

Sources