A coordinated cyberattack affected technology at over 30 municipal water facilities across Minnesota this week, forcing some utilities to switch to manual operations. The Minnesota Information Technology (MNIT) agency announced it is working with federal agencies including the Cybersecurity and Infrastructure Security Agency (CISA), the Environmental Protection Agency (EPA), and the Federal Bureau of Investigation (FBI) to investigate the incident.

Officials have not yet attributed the attacks to a specific actor or confirmed that all incidents were carried out by the same group. Investigators are probing whether Iranian hackers are behind the activity, though sources caution the assessment could change as more evidence is gathered. They are also considering if the actor might have tried to appear Iran-based amid ongoing U.S.-Iran tensions.

The attacks, which occurred on Sunday and Monday, targeted programmable logic controllers (PLCs) and human-machine interfaces (HMIs) used to remotely monitor and control water system equipment. Minnesota IT Services reported that most confirmed cases involved these technologies.

Federal authorities, including the FBI, EPA, and CISA, warned that attackers are targeting internet-exposed industrial controllers used by water and wastewater utilities. In some cases, loss of monitoring and control functionality led to pressure loss and flooding at critical infrastructure sites.

CISA, part of the Department of Homeland Security, stated it is "currently observing a significant increase in cyber threat actors" targeting PLCs in the water and wastewater systems sector and urged critical infrastructure owners and operators to remove publicly exposed PLCs and other operational technology from the internet as soon as possible.

Minnesota’s Chief Information Security Officer John Israel said the state has provided information to federal agencies who are evaluating the activity in a broader national context. FBI Cyber Division Assistant Director Brett Leatherman noted that Iranian actors "continue to target U.S. critical infrastructure" and disrupt essential services.

The Minnesota Department of Health is researching the impact on local water systems and has not received any active requests from cities to modify drinking water usage.

Sources