Federal and state investigators believe a cyberattack that disrupted computerized control systems at more than 30 Minnesota community water systems over the weekend was likely carried out by Iranian hackers, according to officials familiar with the investigation. The attack targeted operational technology used to manage and monitor municipal water towers, and while it forced at least one small city to ask residents to conserve water temporarily, state health officials said there were no active requests for residents to change their drinking water usage.
Minnesota IT Services described the episode as a coordinated cyberattack that struck on Sunday and Monday. Investigators initially pointed to Iran because of the tradecraft involved and because no ransom demand was made, but officials cautioned that the assessment could change as more data is collected. The Minnesota Department of Health said it was not aware of any active requests from Minnesota cities asking residents to modify their drinking water usage.
The city of Braham offered a detailed account of the disruption. Mayor Nate George said a plant operator found that the water tower was calling for water while the well was not operating. After similar problems appeared in at least four other Minnesota communities, Braham staff determined that the plant's computerized control system had been compromised. Public works crews isolated the affected system, restored a backup, and restarted the plant within about 90 minutes. Residents continued receiving water from the city's tower, and city administration temporarily requested that residents conserve water to prevent the tower's limited supply from being exhausted.
President Donald Trump pushed back on the Iran attribution during a Cabinet meeting on Friday. He said he would «blame it on Minnesota and the governor,» calling the state «grossly incompetent» and describing Gov. Tim Walz, a Democrat, as «corrupt.» The president added: «They like to say, oh it's Iran. Iran should be so lucky. Iran has bigger problems than worrying about Minnesota.»
The FBI said it was aware of recent public reporting around the Water and Wastewater sectors and that it remained fully engaged with interagency partners to protect critical infrastructure. Minnesota IT Services stressed that the investigation remains active and that Minnesota has not attributed the activity to a specific actor. John Israel, the state's chief information security officer, said the breach was first detected Sunday and involved 36 municipal water systems. He added that Minnesota was one of the early detectors of this activity and that similar threat activity has likely been occurring in other states across the country.
Nick Andersen, acting director of the Cybersecurity and Infrastructure Security Agency, said the agency was aware of multiple potential incidents affecting local water utilities. The warnings follow a CISA advisory about ongoing Iranian-affiliated cyber activity targeting internet-connected operational technology devices. Brett Leatherman, assistant director of the FBI's Cyber Division, said Iranian cyber actors continue to target U.S. critical infrastructure and that the FBI is committed to identifying, disrupting, and imposing costs on those responsible.
Earlier this week, the FBI and Environmental Protection Agency issued a joint advisory warning critical infrastructure owners and operators about malicious cyber actors conducting cyberattacks against operational technology devices. According to the advisory, water utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations. Minnesota officials said they continue working with federal, state, local, Tribal, and private-sector partners to investigate the attack, support affected communities, and strengthen defenses against future incidents. Israel said cyberattacks against critical infrastructure require a coordinated, whole-of-government response, and Minnesota IT Services is working side by side with partners to share intelligence and help utilities restore operations safely.
