Water Systems In Five More States Hit By Cyberattacks

At least 12 states have reported cyberattacks targeting their water and wastewater systems, according to multiple sources and recent alerts from the FBI and Environmental Protection Agency. The incidents, which began in late July and continued into early August, involved hackers remotely accessing operational technology at municipal water facilities, disrupting operations and forcing some utilities to switch to manual systems.

According to a public service announcement from the FBI and EPA, water utilities in at least seven states confirmed incidents last week, with the number reportedly growing to a dozen states. The federal agencies warned that hackers have exploited internet-facing devices, changing passwords and administrator settings, and causing operational disruptions such as pressure loss or alarms being disabled. In some cases, these disruptions triggered boil water notices or required manual operation of the affected systems, as detailed in an alert from the Cybersecurity and Infrastructure Security Agency.

Minnesota was among the hardest hit, with state officials confirming that over 30 municipal water facilities were targeted between July 26 and 27. Michigan and Rapid City, South Dakota, also reported similar cyber incidents. A spokesperson for Michigan’s Department of Environment, Great Lakes, and Energy said that “all systems continued to operate safely,” and Minnesota authorities stated there was no evidence of drinking water contamination.

The hackers, described as “malicious cyber actors,” targeted specific brands of control systems widely used by U.S. water utilities. The FBI and EPA have not officially named a suspect, but officials and cybersecurity experts have pointed to Iran as a likely source due to similarities with past attacks and ongoing tensions between Washington and Tehran. However, President Donald Trump dismissed these claims, blaming Minnesota’s state leadership instead. Minnesota Governor Tim Walz responded by highlighting recent federal workforce reductions in cybersecurity agencies and pointing to the broader context of rising cyber threats from Iran.

Federal agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), continue to urge water system operators to boost their security by disconnecting critical infrastructure from the internet, using strong password protocols, and limiting remote access. The latest attacks have not resulted in water contamination, but the disruptions have raised alarms about the vulnerability of critical infrastructure nationwide.

Investigations are ongoing, and state and federal officials continue to monitor for additional incidents. Authorities are emphasizing that all water utilities—regardless of size—should immediately review their cyber defenses to protect essential services.