(LOOTPRESS) – More than 30 community water systems across Minnesota were targeted in a coordinated cyberattack this week, prompting utilities to switch to manual operations while state and federal authorities investigate who was responsible.
According to CBS News, investigators are examining whether the cyber activity may be linked to Iranian hackers, though officials caution the attacks have not been definitively attributed. Authorities are also considering the possibility that another group could be attempting to make the attacks appear Iran-based to increase tensions amid the ongoing conflict between the United States and Iran.
Neither Minnesota officials nor the federal government have publicly identified a responsible party.
The attacks primarily targeted internet-connected industrial control systems known as programmable logic controllers (PLCs), which are used to remotely monitor and operate equipment at water and wastewater facilities. Federal officials said the incidents caused some systems to lose monitoring and control capabilities, resulting in pressure loss and localized flooding at certain facilities.
Despite the disruptions, officials stressed that Minnesota’s drinking water supply has not been compromised, and there have been no reports of contaminated water.
The FBI, Environmental Protection Agency (EPA), and Cybersecurity and Infrastructure Security Agency (CISA) issued a nationwide warning Thursday, saying cybercriminals are increasingly targeting internet-exposed industrial control systems used by water utilities. Officials said similar incidents have now been reported in at least seven states, indicating the threat extends well beyond Minnesota.
Multiple Cities Forced Into Manual Operations
Among the communities affected was South St. Paul, where officials discovered suspicious activity early Monday and immediately switched the city’s water system to manual operation. Water and wastewater services continued without interruption, and officials said drinking water quality, pressure, and delivery were never impacted. The city also reported no evidence that customer or resident data was accessed.
In Braham, north of Minneapolis, public works employees noticed a malfunction at the well supplying the city’s water tower. Crews isolated the affected equipment, activated a backup system, and restored operations in about 90 minutes. Officials said residents never lost water service and have since disconnected the vulnerable equipment from public internet access.
Meanwhile, in Plymouth, officials detected compromised PLCs affecting two water towers and 14 sewer lift stations. The city temporarily transitioned to manual operations before restoring normal communications by Tuesday afternoon. Officials emphasized that water treatment, quality, pressure, and service remained uninterrupted throughout the incident.
Plymouth Public Works Director Michael Thompson said crews first noticed communication failures Sunday evening before the situation escalated into an overnight emergency response.
“I think you never expect it to happen to you,” Thompson told CBS News.
Federal Agencies Warn of Growing Threat
CISA said it is seeing a significant increase in cyberattacks targeting water and wastewater utilities across the country.
The agency is urging utilities to immediately disconnect publicly accessible PLCs and other operational technology from the internet whenever possible. Officials also warned that many vulnerable devices are connected through cellular modems installed by vendors or contractors that may not be included in routine cybersecurity assessments.
Investigators noted similarities among the recent Minnesota attacks but have not yet confirmed whether all of the incidents were carried out by the same group.
Echoes of Earlier Iran-Linked Attacks
The latest incidents resemble cyberattacks carried out in 2023, when hackers affiliated with Iran’s Islamic Revolutionary Guard Corps gained access to multiple U.S. water facilities by exploiting internet-connected controllers that were still using default passwords.
Authorities continue to investigate the latest attacks, and officials say determining who was responsible will require additional technical analysis before any formal attribution is made.
