In brief
A surge of coordinated cyber attacks targeting water systems in at least seven US states has raised questions about the attackers’ origins. Experts point to Iran, citing its history of similar strikes and the US Cybersecurity and Infrastructure Security Agency’s investigation into the Minnesota incident. The attacks have largely disrupted operations and eroded public confidence, though no lethal harm to water supplies has yet been confirmed. Analysts warn that unchecked vulnerabilities in aging water infrastructure could enable future compromising operations, potentially delivering chemical or service disruption to communities. Public agencies face a pressing need to upgrade security protocols and remove exposed systems from the internet to mitigate this growing threat.
A wave of coordinated cyber attacks was reported last week across 30+ water systems in Minnesota, with the FBI noting similar breaches in six other states. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is investigating a suspected Iranian link, although the Trump administration has so far denied attribution.
Who may be behind the attacks?
Former U.S. State Department anti‑terror adviser Morgan Wright notes that such patterns are often attributed to North Korea or Iran, with current geopolitics pointing “to Iran” as the likely culprit. Yet some officials consider the possibility that attackers used Iranian-based identities to sow operational discord.
Jake Braun, former acting White House Deputy National Cyber Director, cautioned that the U.S. could be reluctant to admit Iranian involvement, especially under foreign policy pressures.
Evidence of a Pattern
- 2026: U.S. Justice Department disrupted a Handala operation that breached a medical technology firm and released sensitive Israeli military data.
- 2024: Handala was accused by the Justice Department of hacking into U.S. presidential campaign data to spread discord and gather official information.
- 2023: The U.S. Department of Homeland Security warned that the Iranian Revolutionary Guard Corps had targeted U.S. water and wastewater systems, temporarily shutting off water‑pressure equipment in Pennsylvania towns.
- 2020: Two Iranian nationals were charged with cyber‑disinformation, manipulating voter data and threatening pro‑Trump voters.
- 2017: A long‑running ransomware campaign allegedly linked to Iranian hackers targeted local governments, schools, and financial institutions, though explicit state sanction was disputed.
Consequences for Water Supplies
Experts warn that the most immediate threat is not the water supply itself but public trust in the nation’s ability to deliver essential services. Malicious actors could, in theory, sabotage systems, introduce harmful chemicals, or shut off water flow, exacerbating already strained public faith.
The U.S. manages 152,000 public drinking water systems and over 16,000 wastewater facilities; the lack of modern security on many of these legacy devices exacerbates the risk.
Preventive Measures
CISA recommends a range of upgrades – including stripping water systems from internet exposure, resetting passwords, and implementing secure PLCs – to limit attack windows. “Governments need to act,” said Wright, emphasizing that most utilities are publicly run and thus fall under state responsibility.
Shayan Sardarizadeh, BBC Verify contributor
