Iran-Linked Hackers Hit Water Systems in 7 States, Targeting 30+ Utilities

Executive Briefing

• Coordinated cyberattack struck operational technology at over 30 Minnesota water systems on July 26–27, spreading to six other states.
• Investigators preliminarily suspect Iranian hackers, though President Trump disputed the attribution and officials caution the assessment may change.
• CISA had warned in April about Iranian targeting of exposed programmable logic controllers used in water infrastructure, expanding the alert on July 22.
• One Minnesota water plant briefly went offline; other communities switched to manual operations to maintain service with no reported water quality impact.
• Smaller utilities face the greatest risk due to limited cybersecurity budgets, older technology, and lack of dedicated security personnel.