FBI Issues Nationwide Warning After Suspected Iranian Hackers Targeted Water Systems Across Seven States

Urgent questions are being raised about the vulnerability of America’s critical infrastructure as federal investigators probe whether Iranian-linked hackers are behind a wave of cyberattacks that struck water systems across at least seven states last week.The FBI and Environmental Protection Agency have issued a nationwide warning, alerting water and wastewater utilities that malicious cyber actors have been remotely accessing internet-connected control systems, changing passwords and IP addresses, and stripping operators of their ability to monitor equipment. In Minnesota alone, more than 30 community water systems were hit over a 48-hour window beginning last Sunday — the largest coordinated attack on water infrastructure in the state’s history.“Attacks like this illustrate that there are folks who mean the U.S. harm today,” Bryson Bort, founder of cybersecurity firm Scythe, Bryson Borth, told NBC News. “We need to be prepared.”The attacks have sparked an unusual public spat between President Trump and Governor Tim Walz of Minnesota. Speaking at a Cabinet meeting Friday at Camp David, Mr. Trump dismissed the possibility of Iranian involvement and instead pointed the finger at the state’s Democratic leadership.“I think I blame it on Minnesota because they’re grossly incompetent,” Mr. Trump said. “I would blame it on Minnesota and the corrupt governor of Minnesota. They like to say, ‘Oh, it’s Iran.’ Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota.”Mr. Walz fired back on social media, accusing the president of deliberately deflecting responsibility. “Trump knows exactly who is responsible for this attack and knows that other states were hit too,” Mr. Walz wrote on X. “This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran.”The Democratic governor also pointed to federal Cybersecurity and Infrastructure Security Agency budget cuts as a contributing factor, writing, “DOGE took an axe to CISA and left the U.S. exposed to cyber attacks. Thankfully, our experts in Minnesota were able to identify the vulnerability quickly and work with local communities to stop it.”Federal and state officials who briefed Minnesota leaders separately told authorities that Iranian hackers were the likely culprits, according to numerous reports. The FBI stopped short of a public attribution. “The FBI and our interagency partners are fully engaged to protect critical infrastructure, and we remain well-equipped to protect against cyber threats of all varieties,” the bureau said in a statement.A treatment plant in Braham, a city of roughly 1,800, shut down Monday after attackers disabled its control systems. Communities including Plymouth and South St. Paul were forced to shift operations to manual control. No water quality alerts have been issued, and officials say they know of no threat to drinking water.The attackers exploited internet-facing programmable logic controllers — devices known as PLCs — to remotely tamper with configurations. Georgia and Michigan have since reported similar incidents.In its public advisory, the FBI and EPA urged utilities nationwide to take immediate action:Disconnect PLCs from the public internet and route all remote access through secure gateways;Use strong, unique passwords on all devices — never default or blank credentials;Restrict network access using firewall rules and access control lists;Switch physical key switches to “run” mode to block unauthorized changes to device logic;Maintain manual operation capabilities so systems can function if digital controls are lost;Review PLC project files regularly for unauthorized modifications;Plan ahead for end-of-life hardware that no longer receives security patches.If Iranian involvement is confirmed, it would fit a long-established pattern. Between 2011 and 2013, Iranian hackers carried out denial-of-service attacks on 46 American banks, costing victims tens of millions of dollars. A separate actor accessed the control system of a dam at Rye, New York.In 2014, Iranian hackers wiped hard drives and stole customer data from Las Vegas Sands casino, the first “destructive cyberattack carried out on U.S. soil by a nation-state,” the then-director of national intelligence, James Clapper said.From 2016 to 2022, Iranian operatives targeted the State Department, Treasury Department, and multiple defense contractors. Over roughly the same period, Iranian government-linked actors compromised schools, hospitals, and municipal governments, in some cases handing access to ransomware groups.Iran has also targeted American water systems before. In 2024, the IRGC-affiliated group CyberAv3ngers targeted water systems in America and Israel, successfully shutting down pumping equipment at Aliquippa, Pennsylvania. Three Iranian nationals were charged the same year with hacking into accounts linked to an American presidential campaign, later reported to be the Trump campaign.Earlier this year, the Iranian-linked group Handala claimed responsibility for an attack on medical technology company Stryker and separately accessed FBI Director Kash Patel’s personal email account.Investigators caution that formal attribution in the latest attacks could take weeks. They are also examining whether the attackers may have deliberately mimicked Iranian tactics to obscure their true origin.

FBI Issues Nationwide Warning After Suspected Iranian Hackers Targeted Water Systems Across Seven States

FBI Issues Nationwide Warning After Suspected Iranian Hackers Targeted Water Systems Across Seven States

More from the New York Sun

New York Film Festival Review: ‘Behemoth!’ Has Nine Composers and No Heart

Influencer Alix Earle Says She’s ‘Never Read a Book,’ Sparking Fierce Online Backlash

Tom Kim Earns Gold and Military Exemption With Victory at Asian Games

Tennessee Prison Chief Resigns Days After Failed Execution of Christa Pike, Whose Condition Is Described as Dire

If Alito Retires Next Year, Where Will Trump Look for His Next Nominee?

Maryland Becomes First State To Ban Surveillance Pricing in Grocery Stores

Bruce Blakeman for Governor

Keynes and the Ballerina

More from the New York Sun

New York Film Festival Review: ‘Behemoth!’ Has Nine Composers and No Heart

Influencer Alix Earle Says She’s ‘Never Read a Book,’ Sparking Fierce Online Backlash

Tom Kim Earns Gold and Military Exemption With Victory at Asian Games

Tennessee Prison Chief Resigns Days After Failed Execution of Christa Pike, Whose Condition Is Described as Dire

If Alito Retires Next Year, Where Will Trump Look for His Next Nominee?

Maryland Becomes First State To Ban Surveillance Pricing in Grocery Stores

Bruce Blakeman for Governor

Keynes and the Ballerina