A cyberattack has affected water systems in at least seven U.S. states, and the full scope of the damage may be larger, The New York Times reported.
Minnesota was the first state to disclose incidents involving its water infrastructure, followed by Michigan. No formal federal announcement has identified the attacker, but Iran has emerged as the leading suspect in the preliminary investigation.
The FBI and the U.S. Environmental Protection Agency said Thursday that water systems in at least seven states had reported incidents to federal authorities. Officials said there was no indication that drinking-water supplies had been contaminated or disrupted.
Utilities across the country were nevertheless preparing for possible failures in the computer systems used to monitor water quality and chemical levels.
American officials described the scale of the attack as unprecedented. Iran, however, has previously been linked to attempts to compromise water infrastructure abroad.
In 2020, ynet reported that Iran had carried out a cyberattack against Israeli water facilities. A Western intelligence official later told the Financial Times that the operation was intended to increase chlorine levels in water supplied to Israeli homes.
Four Israeli officials and one Western official said at the time that the attackers had penetrated software controlling Israeli water pumps after routing their activity through American and European servers to conceal the code’s origin.
According to the Western official, the attack could have caused the pumps to shut down once abnormal chemical readings were detected. That could have left thousands of Israelis without running water during a heat wave.
U.S. authorities have not concluded that the latest attack was directed by Iran. Officials emphasized that the investigation remains in its early stages and that cyber investigations can take months before firm conclusions are reached.
The New York Times reported that Iran has intensified cyber activity against American targets since the war involving Israel and the United States began. Iranian hackers have also previously attempted to target similar water facilities in the U.S.
The newspaper said the incidents did not appear to be financially motivated, reducing the likelihood that ordinary cybercriminals were responsible.
President Donald Trump played down the reports Friday and questioned whether Iran had carried out the attack.
“I think Minnesota is behind it,” Trump said. “I don’t believe there was an Iranian cyberattack.”
Minnesota Gov. Tim Walz, who served as Democratic presidential candidate Kamala Harris’ running mate in the most recent election, rejected Trump’s remarks.
“This is what modern warfare looks like,” Walz said.
After Trump spoke, federal officials said privately that Iran remained the main suspect, though they stressed that investigators had not yet obtained conclusive evidence.
(Photo: AP Photo/Jacquelyn Martin)
Nate George, mayor of Braham, a small city north of Minneapolis reportedly targeted in the operation, told The New York Times that local and federal authorities had little doubt about who was responsible.
“We are getting bits and pieces of information from the state of Minnesota and the FBI,” he said.
George, a Republican running for Minnesota state auditor, said authorities were “pretty confident” that Iranian actors were behind the attack but were reluctant to say so publicly.
Federal officials declined to identify all the affected states. Michigan, however, confirmed that several communities had reported incidents resembling those described by federal agencies.
“We have received a small number of reports from communities in Michigan indicating activity consistent with what federal agencies have described,” state spokesperson Dale George said.
He added that all affected systems continued to operate safely and that there were “no known impacts posing a public-health concern.”
Alex Orleans, a former U.S. government cybersecurity contractor who specializes in tracking Iranian hacking groups, said Tehran has carried out a wide range of operations against American, Israeli and other Middle Eastern targets since the war began.
The intrusion into American water systems appeared to mark a major escalation, he said.
“What is unprecedented here is that we are seeing direct, tangible effects on control systems inside critical U.S. infrastructure,” Orleans told The New York Times.
The U.S. Cybersecurity and Infrastructure Security Agency said Friday that hackers had targeted “water facilities of all sizes.” It advised operators to disconnect potentially vulnerable controllers from the internet.
The attack had resulted in boil-water notices and the continued manual operation of some systems, the agency said.
Former intelligence officials and cybersecurity experts said the hackers most likely exploited available vulnerabilities rather than selecting particular cities for strategic reasons.
(Photo: GPO)
The reports come amid growing tensions in the Middle East and speculation that military operations against Iran could soon resume.
CBS reported Saturday that an Israeli official said Israel was unaware of any decision to fully renew the military campaign and had not been asked to participate in military action against Iran.
Israel has maintained public silence while waiting for a decision from the White House and seeking to avoid being portrayed as pressing for a wider war.
American embassies across the region, including in Bahrain, Iraq, Jordan, Kuwait, Lebanon, Oman, Qatar, Saudi Arabia, the United Arab Emirates, Egypt and Israel, have issued security warnings urging U.S. citizens to leave or prepare for immediate departure in the event of further escalation.