US Investigates Cyber Breaches on Water Infrastructure Amid Iran Warning

US authorities are investigating a series of cyberattacks targeting more than 30 water systems across Minnesota, raising fresh concerns over the vulnerability of critical infrastructure as federal agencies warn that Iranian hackers have increasingly focused on such facilities.

According to Minnesota IT Services, the attacks occurred on Sunday and Monday, but investigators have not yet identified those responsible. While no residents suffered disruptions to drinking water supplies, one community temporarily urged people to conserve water as officials assessed the situation.

The FBI is leading the investigation but has not publicly attributed the attacks to any group. Last week, the FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and other federal bodies warned that Iranian-linked hackers were actively targeting water and wastewater systems along with operational controls used in other essential sectors.

Cybersecurity experts say local utilities are particularly vulnerable because many lack the resources to install advanced protections or regularly update critical software. Such weaknesses make them attractive targets capable of causing widespread public concern.

Cynthia Kaiser, former deputy assistant director of the FBI's cyber division and now with Halcyon's Ransomware Research Center, said Iran has both the motivation and a documented history of targeting US water infrastructure. She argued that investigators should seriously consider an Iranian connection until evidence suggests otherwise.

Iran-linked cyber activity against US water facilities is not new. In 2016, the US Justice Department charged a group of Iranian hackers over a cyberattack involving a small dam near New York City.

State officials said the confirmed incidents primarily affected technology used to remotely monitor and control water treatment equipment. Investigators noted similarities in timing and the systems targeted but have not concluded whether a single actor coordinated every attack.

The cities of Braham and Plymouth confirmed cyber incidents this week. Officials said drinking water quality remained safe, operational disruptions were quickly managed, and essential services continued while affected systems were restored.