Overview
- The FBI has received reports from water and wastewater utilities in at least seven states since July 27 that unknown actors remotely accessed internet-connected control devices and altered IP addresses and passwords.
- Minnesota reported the largest known impact, saying more than 30 municipal systems showed signs of a coordinated intrusion and at least one system was briefly taken offline.
- CISA has warned that the activity fits tactics it has tied to actors linked to Iran, and major U.S. newspapers citing unnamed officials say preliminary investigations point to Iran but official attribution is not yet definitive.
- State agencies including Michigan and South Dakota say local operators remediated the issues and there are no known widespread threats to drinking-water quality, though officials nationwide remain on alert.
- The incidents highlight that many small utilities rely on internet-connected control devices with limited cyber defenses, a vulnerability that experts say raises urgency for better network segmentation, stronger passwords, and federal support for local operators.