Alleged Iranian hacks hit US water utilities

Attacks reported across about a dozen states disrupted some water operations and renewed concern over exposed internet-connected systems.

The United States is dealing with a wave of cyberattacks on water utilities across several states, drawing attention well beyond the sector itself. The incidents matter because they affect a basic public service people rely on every day, from clean water to wastewater treatment. What makes the case especially sensitive is the possibility that the attacks were coordinated and linked to Iran, though that attribution has not been officially confirmed. That combination — essential infrastructure, multi-state disruption and uncertain blame — has pushed the story into a broader national security debate.

The attacks have also exposed a practical weakness in US infrastructure. The country has more than 150,000 water systems, many run by local operators that may not have the resources or cybersecurity expertise to defend themselves well. As IT-PUB News notes, that wide distribution and uneven protection can make the sector harder to hit at scale, while still leaving smaller utilities vulnerable.

Incidents spread across several states

The first public sign of trouble came on July 28, when Minnesota authorities said water treatment plants in more than 30 communities had been hit by coordinated cyberattacks. Two days later, the FBI said water and wastewater utility companies in at least seven states had reported incidents, and in some cases the attacks had “degraded water operations.”

Since then, reported hacks have also surfaced in Arkansas, Georgia, New Jersey and Michigan, alongside the Minnesota cases. The spread across roughly a dozen states is a big reason the story has raised so much concern. Water utilities are usually seen as local, fragmented targets, so a campaign reaching multiple regions at once stands out.

The source text does not say every incident caused the same level of damage. But even limited disruptions raise serious questions when they involve services tied so closely to public health and daily life.

Iran is the leading suspect, but attribution remains unresolved

At the center of the story is a basic question: who is behind the attacks? Officially, the US government has not named a culprit. Even so, the main suspect is the Iranian government.

That suspicion grew after CISA warned that Iranian hackers were targeting internet-connected devices in water systems and the energy sector. The warning was first published in April and updated before the Minnesota attacks. After the first incidents came to light, Wired reported that WaterISAC, a nonprofit that shares cybersecurity information across the water sector, told members the recent attacks “aligned” with the campaign CISA had warned about.

President Donald Trump, however, said he did not think “there was an Iranian cyberattack” and instead blamed the state of Minnesota. The source notes that his comment came after the attacks were reported there and against the political backdrop of Minnesota being run by Democratic governor Tim Walz, who was chosen as Kamala Harris’ vice president candidate in the 2024 elections.

The Washington Post later reported that US intelligence agencies “are confident” Iran, and specifically the Islamic Revolutionary Guard Corps, is responsible. According to the paper’s sources, that attribution has not been made public because officials are not sure which unit inside the IRGC was involved and may also be reluctant to contradict Trump’s statement.

Exposed online systems raise the stakes

The attacks have renewed attention on how much of the water sector is connected to the internet. Forescout said earlier this month that it found more than 2,800 controllers in US water systems exposed online. Exposure alone does not mean attackers can take control, but it does increase the chance of finding weak points.

In some of the recent incidents, that risk appears to have turned into actual disruption. The FBI said some attacks caused loss of pressure, which could potentially allow untreated groundwater to seep into pipes and lead to flooding. The source presents those as possible consequences, not outcomes seen in every case, but they show how a cyberincident can quickly become a physical infrastructure problem.

There were local effects, too. In Braham, Minnesota, one of the first towns to report an incident, the water plant was taken offline for a few hours and residents were urged to conserve water. Maple Plain, also in Minnesota, briefly declared a state of emergency. In a county outside Atlanta, Georgia, officials temporarily told residents to boil water before using it as a precaution.

Even short-lived attacks can force local authorities to move fast, sometimes with cautionary steps that affect everyday routines. For residents, the immediate impact may be less about visible damage than uncertainty over whether tap water is safe to use.

The fallout reaches beyond the water sector

The significance of the case goes beyond the targeted facilities. Cybersecurity experts have long expected Iranian hackers to focus on easier, isolated targets, so a campaign reaching multiple water systems could mark a more serious escalation. The source also notes that Iranian government hackers have a history of targeting critical infrastructure in the US.

There is also a possible geopolitical angle. The text says the attacks may be part of Iran’s strategy to retaliate against the US because of the six-month war. That remains a possibility rather than a confirmed motive, but it helps explain why the incidents are being watched so closely.

At the same time, the source suggests Iran’s record in this area has been mixed. Until now, Iranian hackers had only limited success against US targets. In March, the hacktivist group Handala disrupted the operations of medical tech company Stryker, and the US government later accused the group of being operated by Iran’s Ministry of Intelligence and Security. The group also claimed responsibility for hacking the personal Gmail account of FBI director Kash Patel.

For the water sector, the immediate lesson is clear enough: cyberattacks do not have to be dramatic to be disruptive. Brief outages, pressure loss or precautionary boil-water notices can unsettle communities. And beyond the technical damage, the attacks may have struck at something harder to measure — public confidence in the safety of something as basic as water.