Glonce

FBI: Iran-linked hackers hit water utilities in seven US states

securityThe Glonce editorsWired🔥66Glonce rating66Impact75Novelty65Relevance60Surprise70Players25Credibility80
FBI: Iran-linked hackers hit water utilities in seven US states

The FBI has warned that a wave of cyberattacks against US water and wastewater utilities, first traced to more than 30 utilities across Minnesota in a single week, has hit utilities in no fewer than seven states. WIRED reports it obtained a memo tying the attacks to Iran, which it describes as the first official documentation of Iran's likely responsibility for what is already the most impactful cyberattack campaign to hit the US since a war involving Iran began roughly six months ago. The FBI's alert did not name the affected states or detail the extent of the disruption or damage. The bureau said it and the Environmental Protection Agency are working with the affected utilities. The Cybersecurity and Infrastructure Security Agency, in its own advisory issued the same week, said the attacks had in some cases disabled digital controls and "resulted in boil-water notices," pointing to possible water contamination. The leading suspect remains Iranian-affiliated hackers, an attribution first laid out in a CISA advisory back in April; WIRED says the leaked memo it obtained confirmed that earlier advisory was connected to the more recent Minnesota attacks. Before this alert, the Minnesota utility attacks were already described as perhaps the broadest, most disruptive hacking campaign ever to target American industrial control systems, the technology linking digital software to physical equipment in critical infrastructure. President Donald Trump, rather than endorsing the Iran attribution, blamed the administration of Minnesota's Democratic governor Tim Walz for the attacks on Friday, a response WIRED compares to his past denial of Russia's 2016 hack of the Democratic National Committee even after US intelligence agencies had pinned that intrusion on the Kremlin.

Key facts

  • More than 30 water and wastewater utilities across Minnesota were hit with cyberattacks in the space of a week.
  • The FBI says the campaign has now hit utilities in no fewer than seven US states, without naming which ones or detailing the damage.
  • CISA's advisory says the attacks disabled digital controls in some cases and led to boil-water notices.
  • A memo obtained by WIRED ties the campaign to Iran, echoing a CISA advisory from April that first named Iranian-affiliated hackers as the leading suspects.
  • President Trump blamed Minnesota governor Tim Walz's administration for the attacks instead of endorsing the Iran attribution.

Why it matters

WIRED calls this the first official documentation of Iran's likely responsibility for the most impactful cyberattack campaign to hit the US during the roughly six-month-old war involving Iran. Even before the FBI's seven-state warning, the Minnesota attacks were already described as perhaps the broadest, most disruptive hacking campaign ever aimed at American industrial control systems, the software that governs physical equipment in critical infrastructure like water treatment.

Who it affects

Water and wastewater utilities across at least seven US states, starting with more than 30 in Minnesota, are directly targeted. Residents of some affected areas were put under boil-water notices after digital controls were disabled. The FBI, the Environmental Protection Agency and CISA are jointly involved in the response.

How to use it

The FBI, echoing CISA's advisory, told utilities to immediately take internet-connected programmable logic controllers, the devices that bridge digital systems and physical equipment, off the internet, secure them with strong passwords, and set up allow-lists so only authorized devices can connect to them.

How solid is it

The account rests on a leaked memo WIRED says it obtained, an FBI alert, and a CISA advisory, which together make this the first official documentation of the suspected Iran link. That said, the FBI alert itself does not name the seven states or quantify the disruption, and Iran remains described as the "leading suspect" rather than a confirmed, officially attributed actor; the April CISA advisory that first raised the Iran link is being cited again rather than a fresh independent finding.

Risks and caveats

Key details are missing from the public record: which states beyond Minnesota were hit, how much damage or disruption occurred, and the timeline of the additional attacks relative to the Minnesota campaign. President Trump's response, blaming Minnesota's Democratic governor's administration rather than addressing the Iran attribution, is framed by WIRED as a partisan echo of his earlier denial of Russia's 2016 DNC hack despite US intelligence agencies having pinned that intrusion on the Kremlin.

“resulted in boil-water notices”

— Cybersecurity and Infrastructure Security Agency advisory