Iranian hackers suspected in cyberattack on Minnesota water systems

A coordinated cyberattack struck more than 30 municipal water systems across Minnesota over the weekend, disrupting automated controls at treatment plants and water towers in communities including Braham, Plymouth, Maple Plain, and South St. Paul. State.

Federal officials say the intrusions targeted operational technology such as programmable logic controllers and supervisory systems that manage pumps and monitoring, forcing some utilities to switch to manual operations.

Investigators believe the attacks were probably the work of Iranian hackers, according to US and state officials familiar with the probe cited by US media.

The assessment remains preliminary and could change as more technical data is analyzed.

Three state officials briefed on the investigation said the tradecraft used and the absence of any ransom demand pointed toward Iranian actors rather than typical cybercriminals seeking payment.

“The F.B.I. is aware of the incident and in contact with victims to resolve the matter,” said Matthew Vogel, a spokesman for the bureau.

Officials cautioned that the hackers could be attempting to pose as Iran-based actors to escalate tensions, though former intelligence officials described that scenario as unlikely.

John Israel, Minnesota’s chief information security officer, said hackers targeted roughly 36 systems as part of a breach first detected on Sunday.

“Minnesota was one of the early detectors of this, but we’re seeing that this same threat activity has likely been occurring in other states throughout the nation,” he said.

As of mid-week, there was no indication that any breaches contaminated water or disrupted delivery.

In Braham, a city of about 1,700 people roughly 65–70 miles north of Minneapolis, public works staff discovered the well feeding the water tower was malfunctioning early Monday.

“Public works isolated the affected system, restored a backup and restarted the plant within approximately 90 minutes,” Mayor Nate George said in a statement.

Residents were briefly asked to conserve water before the advisory was lifted.

The attack shut down operating controls for the well and treatment plant, temporarily leaving the city reliant on water stored in its tower. Water quality was unaffected.

Plymouth, a suburb of about 80,000, reported that communications with its water infrastructure were restored by Tuesday afternoon.

Crews continued operating the system manually during the outage, with no impact on water levels or quality.

Minnesota IT Services emphasized that “impacted” status confirmed malicious activity involving system technology but did not mean every community experienced service disruption.

By Thursday, no active requests remained for residents to modify drinking-water usage.

The incident comes amid heightened US-Iran tensions and follows recent federal warnings.

The Cybersecurity and Infrastructure Security Agency, FBI, and other agencies had issued an advisory noting that Iranian-affiliated cyber actors were targeting water and wastewater systems and other critical infrastructure operational controls.

Nick Andersen, acting director of CISA, said the agency was aware of “multiple potential incidents affecting local water utilities.”

Cybersecurity experts noted strong similarities to past activity by groups such as CyberAv3ngers, linked to Iran’s Islamic Revolutionary Guard Corps.

Cynthia Kaiser, a former senior FBI official who oversaw foreign government cyber investigations, said several clues pointed to Iran, including the focus on disruption rather than financial gain and
Tehran’s demonstrated interest in US water systems.

“Almost every initial assumption of attribution turns out to be true,” Kaiser said.

“I think most credible researchers and responders would be right to treat it like it’s Iran until proven otherwise.”

Iran has a history of targeting US water infrastructure, including a 2016 case involving a dam near New York City.

Local utilities often operate with aging technology and limited cybersecurity resources, making them attractive targets.

Mayor George of Braham called the episode “a warning to policymakers in St. Paul,” noting that Minnesota’s local governments are expected to defend essential systems against foreign adversaries “often with limited staff, aging technology and inadequate resources.”