Suspected Iranian Hack Wave Hits Water Systems Across a Dozen US States

Inside the Coordinated Water Utility Hack Wave

Since late July, a wave of cyberattacks has struck water and wastewater utilities across the United States, triggering local emergencies, boil-water advisories and a federal investigation. Minnesota authorities first reported on July 28 that treatment plants in more than 30 communities had been targeted. Within days, the FBI said utilities in at least seven states had reported incidents, with some attacks degrading water operations. Additional reports later emerged from Arkansas, Georgia, New Jersey and Michigan.

The suspected culprit is the Iranian government, specifically the Islamic Revolutionary Guard Corps, according to unnamed U.S. intelligence sources cited by The Washington Post. But no official attribution has been made public. The campaign followed an updated CISA warning about Iranian hackers scanning internet-connected equipment in water and energy systems. President Donald Trump publicly disputed the Iran link and instead blamed Minnesota's Democratic state leadership, a claim that has complicated the public narrative.

For now, the physical consequences appear limited. Some communities lost water pressure—a condition the FBI said could allow untreated groundwater to enter pipes—while Braham, Minnesota, took its plant offline for hours and asked about 1,700 residents to conserve water. Maple Plain briefly declared a state of emergency, and a county near Atlanta issued a precautionary boil-water notice. The broader impact may be psychological: a basic utility has been shown to be vulnerable.

Why the Water Sector Was an Obvious Target

The Fragmented Water Sector Was the Real Target

The United States has more than 150,000 water systems, many run by small local operators with limited cybersecurity budgets and expertise. That fragmentation makes it harder to attack all systems at once, but it also means individual utilities often lack the defenses to monitor or lock down internet-exposed equipment. Cybersecurity firm Forescout recently found more than 2,800 controllers in U.S. water systems exposed online—an inventory that gives state-aligned hackers a wide menu of low-effort targets.

Why This Looks Like an Escalation

Iranian-linked groups have a record of probing U.S. critical infrastructure, but past efforts were generally opportunistic and isolated. A coordinated campaign hitting communities in at least seven states, if confirmed, would represent a notable shift toward broader operational disruption. The FBI's confirmation that some incidents caused pressure loss and flooding risk supports the view that the attackers were not merely conducting reconnaissance, even where their access did not produce lasting physical damage.

The Attribution Fight Is Political as Well as Technical

CISA had warned in April—and updated before the Minnesota attacks—that Iranian actors were targeting internet-connected devices in water and energy systems. The nonprofit WaterISAC separately told members the attacks aligned with that CISA campaign. Yet President Trump rejected the Iranian link and blamed Minnesota's governor, Tim Walz, a prominent Democratic figure. That public split may explain why intelligence agencies have not formalized attribution: sources told The Washington Post they are still unsure which IRGC unit was responsible and are wary of contradicting the president.

What Utility Operators and Regulators Should Do Next

• Water utility boards should immediately inventory and segment internet-facing operational technology. Forescout's finding of more than 2,800 exposed controllers in U.S. water systems is a concrete starting point for an internal audit.
• Operators in states named in the FBI's investigation—Minnesota, Arkansas, Georgia, New Jersey and Michigan—should review their remote-access logs and industrial control system accounts for signs of the CISA-described Iranian activity, even if they have not yet seen an outage.
• Local emergency managers should pre-draft public communications for water pressure loss and boil-water scenarios. Braham's need to ask residents to conserve water and the Atlanta-area boil notice show how quickly operational status can change.
• Federal and state regulators should prepare for renewed calls to set minimum cybersecurity standards for water systems. The CISA warning and the multi-state FBI investigation have already put utilities on notice that voluntary guidance is not containing the exposure.
• Cybersecurity vendors and managed security providers should treat the fragmented municipal water market as a near-term demand signal, focusing on low-cost OT monitoring for utilities that lack full-time security staff.