US officials are investigating a wave of cyberattacks targeting water systems across several states, with authorities increasingly suspecting Iran’s involvement amid heightened tensions following the conflict between Washington, Israel and Tehran.
Officials stressed there is no evidence that drinking water has been contaminated or made unsafe, but the attacks have raised concerns over the security of critical infrastructure that manages water treatment, pressure and chemical levels.
The incidents were first reported in Minnesota, with Michigan later confirming similar suspicious activity. Authorities and cybersecurity experts believe the attacks may extend well beyond the seven states currently identified.
Officials Investigate Possible Iranian Role
Federal officials said the investigation remains in its early stages and no definitive forensic evidence has yet established Iran’s responsibility. However, intelligence assessments reportedly consider Tehran the leading suspect, citing a recent increase in Iranian cyber operations against US critical infrastructure.
Officials noted that Iran has previously targeted American water utilities and other infrastructure, and investigators have found no apparent financial motive, making ordinary cybercrime less likely.
Trump Questions Iran Connection
President Donald Trump downplayed reports linking Iran to the attacks, suggesting instead that Minnesota was responsible.
“I think Minnesota is behind it. I don’t think there was an Iranian cyberattack,” Trump told reporters on Friday.
Minnesota Governor Tim Walz rejected the claim, saying the incidents demonstrated the realities of modern cyber warfare.
Despite Trump’s remarks, federal officials privately maintained that Iran remains the primary suspect while emphasising that cyber investigations often take months before definitive conclusions can be reached.
Water Systems Continue Operating Safely
Officials in affected states said water treatment facilities continue to operate safely despite the attacks.
A spokesperson for Michigan said several communities reported activity consistent with the federal government’s warning, but there had been no known public health impacts.
Authorities have instructed utilities to strengthen cyber defences and, where possible, disconnect vulnerable internet-connected control systems from public networks.
Experts Warn of Major Escalation
Cybersecurity specialists described the attacks as an unprecedented attempt to interfere with industrial control systems managing essential public services.
Alex Orleans, chief of threat intelligence at cybersecurity firm Sublime Security and a former US government contractor, said the attacks represented a significant escalation in Iranian cyber activity.
He said the hackers appeared to be targeting vulnerable operational systems across the country rather than focusing on specific cities, suggesting any utility using outdated internet-connected equipment could be at risk.
Federal Agency Issues Warning
The Cybersecurity and Infrastructure Security Agency (CISA) recently warned that hackers were targeting water utilities of all sizes and advised operators to remove vulnerable controllers from the internet whenever possible.
According to CISA, some attacks have forced facilities to rely on manual operations and have resulted in precautionary boil water notices in certain locations.
The agency has warned for months that Iran could attempt to compromise US water systems and other critical infrastructure.
Small Communities Face Growing Challenges
Officials in smaller municipalities said the attacks exposed longstanding weaknesses in ageing infrastructure.
Nate George, mayor of Braham, Minnesota, said emergency guidance had helped local officials secure affected systems, but warned that upgrading ageing information technology networks remains a major financial challenge for smaller communities.
“We need to move toward a more secure system,” George said, noting that cybersecurity improvements are expensive for small municipalities with limited resources.