Hackers Hit More Than 30 Minnesota Water Systems, and Investigators Are Asking Whether Iran Did It

Malicious cyber activity struck the technology running more than 30 community water systems across Minnesota this week, forcing several utilities to shut off their remote controls and operate pumps and valves by hand while state and federal investigators try to work out who was behind it, CBS News reported Thursday.

Investigators are examining whether the intrusions are the work of Iranian hackers, according to U.S. officials and sources familiar with the incident. Those sources cautioned that nothing has been definitively attributed, and that their assessment could shift as more technical evidence comes in. They are also weighing the possibility that the attacker deliberately made the activity look Iranian in order to stir up trouble while the United States is in open conflict with Tehran. Neither Minnesota nor the federal government has publicly named a culprit.

The FBI, the Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency all issued warnings Thursday that attackers are hunting for internet-exposed industrial controllers used by water and wastewater utilities. In at least some cases, federal authorities said, operators lost monitoring and control of equipment, which led to pressure loss and flooding. The agencies did not name affected states, but the FBI and EPA said the problem reaches beyond Minnesota, with incidents reported in "at least seven states."

Most of the confirmed Minnesota cases involved programmable logic controllers — the small industrial computers that let operators watch and adjust water equipment remotely — according to Minnesota IT Services. None of the state's water supply has been reported compromised, said Mike Ernster, a public information officer for the Minnesota Department of Public Safety, who added that the Bureau of Criminal Apprehension's Minnesota Fusion Center is working with municipalities and with state and federal partners.

Nick Anderson, acting director of CISA, confirmed the agency "is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLC) at water utilities," and urged operators to "remove publicly exposed PLCs and other operational technology from the internet as soon as possible." CISA warned that even utilities with mature security programs should re-check their external connections, because the targeting includes cellular modems installed by vendors or integrators that may never have been documented or scanned.

The disruptions played out quietly in small public works departments. In suburban Plymouth, officials detected an outage Sunday evening after spotting compromised controllers at two water towers and fourteen sewer lift stations, then pulled those devices off the cellular network and ran the system manually until normal communications were restored Tuesday afternoon. "I think you never expect it to happen to you," said Michael Thompson, Plymouth's director of public works, who described an all-hands situation just after midnight Monday. In Braham, north of Minneapolis, crews noticed the well feeding the city's tower malfunctioning, isolated the system, restored a backup and restarted the plant in about 90 minutes, Mayor Nate George said; the tower normally holds about two days of drinking water. South St. Paul moved to contingency procedures early Monday and found no sign that customer data was touched.

Iran-linked hackers have gone after American water utilities before. Federal agencies previously confirmed that actors affiliated with Iran's Islamic Revolutionary Guard Corps used a nearly identical playbook in 2023, reaching multiple water and wastewater facilities by exploiting internet-connected controllers that had been left on their default passwords.