Federal investigators examine Iran link to water-system cyberattacks across seven states

Why it matters

The attackers reached technology that controls wells and treatment equipment, turning a cyber intrusion into a physical infrastructure event. Attribution remains unresolved, but the campaign matches a threat federal agencies warned utilities about days earlier.

Federal investigators are examining whether Iranian state-backed hackers were behind cyberattacks reported at water and wastewater systems in at least seven states, according to a report posted by OSINTdefender on X, after malicious activity reached operational technology at more than 30 community water systems in Minnesota.

The Minnesota attacks occurred on July 26th and 27th. State officials described them as coordinated, though investigators have not publicly attributed the incidents to Iran or determined that one actor was responsible for every attack. The FBI is investigating, The Associated Press reported.

Minnesota IT Services said the affected technology was used to remotely monitor and control water equipment. The state's count reflects systems where investigators confirmed malicious activity, rather than 30 communities that lost water service.

Four municipalities identified in local reporting were Plymouth, South St. Paul, Maple Plain and Braham. FOX 9 reported that the effects in those communities were limited or contained.

Braham, a city of about 1,700 people north of Minneapolis, asked residents to minimize water use for several hours on July 27th after attackers shut down controls for its well and water treatment plant. The city temporarily relied on water stored in its tower. Officials said the incident did not affect water quality.

Plymouth, which has about 80,000 residents, restored communications with its water infrastructure by the following afternoon. Operators kept the system running during the outage, and the city reported no effect on water levels or quality.

Those outcomes show how redundancy and manual operations can contain an intrusion after attackers reach industrial equipment. They also establish that the activity went beyond an attempted breach of office email or municipal records. In Braham, hackers interfered with the controls used to operate physical infrastructure.

Federal agencies had warned about exposed controllers

The attacks followed a July 22nd update to a federal cybersecurity advisory on Iranian-affiliated actors targeting internet-connected operational technology across the United States. The advisory, first issued on April 7th, said attackers had manipulated programmable logic controller project files and information displayed through human-machine interfaces and supervisory control systems.

The updated advisory expanded the equipment identified as targets beyond Rockwell Automation and Allen-Bradley controllers to include devices made by Schneider Electric, Siemens and potentially other manufacturers. Federal agencies assessed that an Iranian-affiliated group was seeking disruptive effects across water, energy and government facilities.

That warning does not establish that the same group carried out the Minnesota attacks. Minnesota IT Services said investigators had found similarities in timing and the types of technology involved, while attribution remained unresolved.

Iran-linked hackers have targeted water infrastructure before. A federal advisory has tied the CyberAv3ngers persona, also known as Shahid Kaveh Group, to Iran's Islamic Revolutionary Guard Corps Cyber Electronic Command. In 2023, the group compromised internet-exposed controllers used by water and wastewater operators in several states. Federal guidance has repeatedly urged operators to remove programmable logic controllers from direct internet exposure, replace default credentials and restrict remote access.

The Minnesota incidents also landed in a state where community water systems using operational technology have been required to complete annual cybersecurity assessments since 2024. The Minnesota Department of Health's rules cover systems using equipment such as supervisory control and data acquisition technology.

John Israel, Minnesota's chief information security officer, said the state activated its cyber incident response capabilities and coordinated with federal agencies, private-sector partners and affected communities. The response limited the immediate damage, but the attackers still found a path into systems that control essential municipal equipment.

The investigation now turns on whether forensic evidence connects the attacks across multiple states and whether the activity matches the infrastructure, techniques or operators identified in the federal Iran advisory. Until that attribution is established, the confirmed facts remain narrower: hackers reached operational technology, disrupted controls at at least one water plant and tested the defenses of dozens of municipal systems in a two-day campaign.