Cyber actors suspected by United States authorities of links to Iran have targeted water and wastewater utility systems in at least a dozen American states, according to a report by ABC News citing multiple sources. The Federal Bureau of Investigation previously confirmed that malicious cyber activity had struck such systems in seven states, resulting in a loss of monitoring and control functionality, though no widespread disruption to water supplies has been reported.
The FBI advisory detailed that the intrusions disabled alarms and altered passwords, effectively blinding utility operators. At least five additional states have since reported similar attacks, bringing the total to at least twelve. Media reports have identified Michigan, Minnesota, New Jersey, South Dakota, and Georgia among the affected states. Michigan State Police confirmed that despite the breach, all systems continued to operate safely, local operators resolved the issues, and no public Health concerns arose.
The FBI has urged utility operators to disconnect systems from the internet where possible, implement secure software, and prepare to switch to manual controls if necessary. Cybersecurity experts have long warned that insufficient protections at water treatment facilities across the country leave critical infrastructure vulnerable to hostile actors, a weakness underscored by the recent wave of intrusions.
Tehran has not commented on the allegations. Over the years, Washington has accused Iran of attempting to hack banks, infrastructure, and the communications of high-ranking officials, allegations the Islamic Republic has consistently denied.
The attribution has sparked political debate. Former President Donald Trump, speaking during a cabinet meeting at the time, rejected the assessment linking Iran to the hacks. He suggested instead that incompetence by local authorities in Minnesota was to blame and criticized the state’s governor, Tim Walz. Governor Walz responded that the former president was aware of the true culprits and the multi-state scope of the attacks, characterizing the incidents as modern warfare and evidence of a lack of coherent strategy regarding Iran. As investigations continue, the focus remains on hardening the digital defenses of essential water systems against evolving threats.
