This post was originally published on this site.
U.S. officials are investigating whether Iranian hackers were behind a coordinated cyberattack on more than 30 municipal water systems in Minnesota, with intelligence agencies reportedly viewing Tehran as the likely culprit — though they have not yet reached a final conclusion.
On Friday, President Donald Trump dismissed reports that Iran is behind the attacks, instead blaming the state and its “corrupt” governor, Tim Walz.
“We heard in Minnesota there was a cyberattack and they blame it on Iran,” Trump said during a cabinet meeting at Camp David, Maryland. “I don’t think so. I blame it on Minnesota because they’re grossly incompetent.”
“Iran’s got bigger problems than worrying about Minnesota,” he added.
The attacks in question targeted operational technology used to monitor and manage local water systems. At least one city’s well and treatment plant briefly went offline, while other communities used manual workarounds after automated systems were disrupted.
State officials said there was no indication that any water supply was unsafe to drink. Minnesota’s health department was not aware of any active requests for residents to change their drinking water use.
How the attack played out
Minnesota officials said the attacks took place Sunday and Monday and triggered a statewide cybersecurity response to help affected communities.
In Braham, a city about 65 miles north of Minneapolis, public works crews discovered the problem early Monday. Mayor Nate George, a Republican candidate for Minnesota state auditor, said the city “isolated the affected system, restored a backup, and restarted the plant within approximately 90 minutes.” Residents continued receiving water from the city’s water tower while the plant was offline.
In Plymouth, several devices that help control water and sewer operations were hacked and taken offline before being restored. The city said the water supply was not affected.
Why these systems are vulnerable
The attacks focused on programmable logic controllers, or PLCs, according to the Cybersecurity and Infrastructure Security Agency. These are industrial control devices that help run equipment such as pumps, sensors, alarms and water-level systems.
Cybersecurity officials warned that PLCs connected directly to the internet are vulnerable, especially when they use default passwords or remote-access connections that utilities may not have fully documented. CISA said the “threat actors are targeting water entities of all sizes.”
Kurt Gaudette, head of intelligence at critical infrastructure cybersecurity firm Dragos, described the pattern to The Washington Post as “very low-hanging fruit.” He said recent attacks have targeted small utilities using exposed controllers with default passwords.
CISA urged utilities to disconnect PLCs from the public internet, change default passwords and use secure remote-access tools instead.
The Iran link
U.S. intelligence agencies have assessed that Iran was likely behind the Minnesota attacks, according to officials cited by The New York Times, The Washington Post and several other media outlets. The Times reported that investigators view the assessment as preliminary and are still collecting technical evidence.
Officials said the lack of a ransom demand and the attack’s disruptive nature helped point investigators toward Iranian hackers. Former officials and cybersecurity experts also noted that Iran has recently shown interest in U.S. water systems.
The FBI is investigating and said it is in contact with victims.
A wider warning for critical infrastructure
The news of the Minnesota attack came days after federal agencies updated a cybersecurity advisory warning that Iranian-affiliated hackers were targeting internet-connected PLCs across U.S. critical infrastructure.
The advisory said the activity has affected local government, water and wastewater, and energy systems. In some cases, hackers manipulated control displays, interfered with project files and caused operational disruption or financial losses.
CISA issued another alert July 30, noting a “significant increase” in cyber threat actors targeting PLCs in the water and wastewater sector.
Why it matters now
The suspected Iran link comes while the U.S. is still at war with the country.
Cybersecurity experts said the attacks appear aimed less at causing mass physical damage and more at creating disruption, fear and political pressure. Alex Orleans, head of threat intelligence at Sublime Security, told the Post Iran’s cyber strategy is two-fold: to show Americans that war carries costs at home while also showing Tehran that its cyber operators are contributing to the war.
What remains unclear
Investigators have not publicly confirmed who carried out the attacks, and officials cautioned that the attribution could change.
It is also unclear how extensively each system was compromised and how much similar activity is occurring in other states. Minnesota’s chief information security officer told the Times the state detected the threat early, but that similar activity has likely been happening elsewhere in the country.
Round out your reading
- What does low water at the Hoover Dam mean for power in the American West?
- Could GLP-1 drugs become the first longevity medications? Scientists think it’s possible.
- ChatGPT told him he wouldn’t face charges. Then came the arrest warrant.
- How one small city built a second act as a bio hub inside empty cigarette factories.
- If permanent Daylight Saving Time is so popular, why is it dead in the Senate?