Water cyberattack hits at least 7 states

You probably never think about the computer systems behind your kitchen faucet. You turn the handle and expect clean water. That familiar routine suddenly felt far less certain in Minnesota and six other states.

A coordinated cyberattack targeted operational technology at more than 30 community water systems on Sunday, July 26, and Monday, July 27. Minnesota IT Services, known as MNIT, activated the state’s cybersecurity response and brought in federal agencies to help investigate.

One water plant temporarily went offline. Meanwhile, other communities reported problems involving automated controls or communications equipment. Workers switched to manual operations or used backup procedures to keep essential services running. Fortunately, state officials reported no active requests for residents to reduce or change their drinking water use.

The FBI has since said that water or wastewater utility companies in seven states have been affected.

“Some of that activity degraded water operations,” the bureau said.

This water cyberattack raises an uncomfortable question for towns across America. How many local utilities could keep operating if hackers gained access to the computers controlling their equipment?

INVESTIGATORS BELIEVE IRANIAN HACKERS ARE LIKELY BEHIND CYBERATTACK ON MINNESOTA WATER SYSTEMS: REPORT

CyberGuy Live: Missed “Sick of Spam?” Get the replay and checklist

Our free CyberGuy Live class, “Sick of Spam?”, has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt “CyberGuy” Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

What happened in the Minnesota water cyberattack

The attack targeted operational technology, commonly called OT. These systems control physical equipment such as pumps, valves and treatment machinery. In Braham, city officials initially reported that the water plant had gone offline for an unknown reason. Crews restored the facility within hours and said it was again filtering and treating water as expected.

Officials later blamed the outage on a malicious cyberattack against computerized operating systems. The city relied on water already stored in its tower while crews worked on the problem. Plymouth reported communications problems involving two water towers and several wastewater lift stations. However, officials said water levels and water quality remained unaffected.

South St. Paul also identified a cybersecurity incident involving automated water utility controls. Public Works employees used established contingency procedures to maintain normal water and wastewater operations. Maple Plain publicly confirmed that its water utility technology had also been targeted.

In total, four communities have publicly described specific effects, although MNIT says attackers targeted more than 30 systems statewide. That difference is important. Being targeted does not mean every system suffered a shutdown. However, it shows that someone tried to reach a large number of local utilities within a short period.

Who may be behind the Minnesota water cyberattack

Officials have not announced a definitive attribution. However, a July 30 report from The New York Times says investigators preliminarily believe Iranian hackers were probably responsible. The report cited U.S. and state officials familiar with the investigation, but President Donald Trump said he rejected the suggestion that Iran was behind the breaches.

Those officials cautioned that the assessment could change as investigators collect more technical evidence. They also have not ruled out the possibility that attackers tried to make the activity appear Iranian. Therefore, Iran should be described as the leading preliminary suspicion rather than the confirmed attacker.

The timing has drawn attention because CISA warned in April that Iranian-affiliated hackers were targeting internet-exposed programmable logic controllers. These devices help control machinery and other equipment at water systems and additional critical infrastructure facilities. CISA initially highlighted certain Rockwell Automation and Allen-Bradley controllers. On July 22, the agency expanded its warning to include equipment from Schneider Electric, Siemens and potentially other manufacturers.

Still, federal officials have not publicly tied that campaign to the Minnesota incidents. CyberGuy has previously examined Iran’s expanding cyber threat to U.S. critical infrastructure. Water systems remain attractive targets because even a limited disruption can create fear far beyond the equipment involved.

IRAN-LINKED HACKERS TARGET US MEDICAL TECH COMPANY

Why water system cyberattacks threaten U.S. communities

Minnesota’s experience could happen in any state. The United States has close to 170,000 drinking water and wastewater systems. Many now connect physical equipment to internet-enabled technology so workers can monitor facilities from a distance. That remote access helps utilities manage equipment spread across wide service areas. However, it may also give an attacker a route into vital controls when operators fail to secure the connection.

Smaller communities often face the greatest challenge. The Government Accountability Office says water systems have widely different cybersecurity capabilities. Many also use older technology that can be difficult to update. At the same time, utilities must stretch limited budgets across essential repairs and regulatory requirements. Cybersecurity upgrades may compete with work that residents can see, such as replacing aging equipment.

A large utility may employ dedicated security professionals. A small town may rely on plant operators who already handle daily operations and after-hours problems. As a result, the communities with fewer resources may also have less ability to monitor suspicious activity around the clock.

Foreign governments have already shown interest in those weak spots. CyberGuy previously reported how Chinese hackers gained access to critical American systems, including infrastructure connected to water and energy. The attacker may change. The underlying weakness often looks familiar: exposed equipment, outdated technology or remote access that lacks strong protection.

Could a cyberattack make drinking water unsafe?

A cyberattack against a water utility does not automatically mean the water has been contaminated. In Minnesota, officials reported no known impact on drinking water quality. They also told residents in publicly identified communities that normal water use could continue.

However, a successful attack can cause more serious consequences. The EPA warns that hackers could disrupt treatment or damage equipment. In a worst-case situation, attackers might also interfere with processes that protect water quality.

Manual operations can provide an important safety net. Minnesota workers used those procedures to keep systems running while investigators examined affected technology. Still, a manual backup only helps when employees know how to use it. Utilities need to test those procedures before screens go dark and alarms stop reporting correctly.

How CISA says water utilities should strengthen security

CISA published new international guidance on July 28 called “CI Fortify: Advice for Isolating Vital Systems.” The guidance urges critical infrastructure operators to separate vital operational technology from less trusted networks. That isolation can help an essential service continue operating when another part of the organization becomes compromised.

CISA released the guidance on the same day MNIT publicly announced the statewide attack. However, the agency has not said it created the document in response to Minnesota. For water utilities, stronger protection may begin with removing unnecessary internet exposure. When remote access remains necessary, CISA advises placing security controls in front of programmable controllers.

Utilities should also change factory passwords and give employees separate login credentials. EPA inspectors have found water systems that continued using default passwords. Inspectors also discovered shared staff accounts or access that remained active after employees left.

Another EPA finding needs careful context. The agency says more than 70% of inspected systems violated basic federal risk assessment or emergency response planning requirements. That figure does not mean 70% had confirmed cybersecurity breaches. However, inspectors found serious digital security weaknesses at some of those facilities.

TRUMP REJECTS IRAN BLAME FOR MINNESOTA CYBERATTACK, POINTS FINGER AT ‘CORRUPT’ POLITICAL FOE

What to do if your water utility reports a cyberattack

Residents cannot secure a municipal treatment plant themselves. However, a few steps can help you receive reliable information and avoid scams during an incident.

1) Follow official local instructions

Check your city, county health department or water utility website for updates. Officials will tell you whether you need to reduce water use or boil tap water. Avoid making decisions based on an unverified neighborhood post.

2) Do not assume the water is contaminated

A cyberattack may affect communications or automated equipment without changing water quality. Continue normal use unless local officials provide different instructions. However, follow any boil-water notice immediately if one appears.

3) Make sure emergency alerts are enabled

Your city may use text messages, automated calls or government phone alerts during a service disruption. Take a moment to check the emergency alert settings on your iPhone or Android. Also sign up for your city’s local notification system if one is available.

4) Keep a small emergency water supply

A backup supply can help during any water interruption, whether it begins with a cyberattack or equipment failure. The CDC recommends storing at least one gallon of water per person each day for three days. Households may need more for pets or people with medical needs.

5) Watch for fake utility messages

Scammers often take advantage of outages and breaking news. You may receive a message claiming that your water bill failed or that your service will be disconnected. Another message may offer bottled water assistance through a payment link. Do not use the phone number or link inside an unexpected message. Instead, contact the utility through its official website or the number printed on your bill. CyberGuy has also explained how scammers impersonate water and other utility companies by spoofing familiar phone numbers.

Kurt’s key takeaways

Minnesota contained a troubling attack without a known drinking water emergency. Workers restored Braham’s plant while other utilities relied on manual controls or contingency procedures. However, the number of systems targeted should get the attention of every governor and mayor in America. Hackers apparently found a way to reach dozens of local utilities during the same two-day period. The preliminary suspicion involving Iranian hackers also raises the stakes. Still, investigators need more evidence before anyone treats that attribution as settled. Every community should know which water controls face the internet and whether workers can operate essential equipment manually. States should also help smaller towns that cannot afford their own cybersecurity teams.

How confident are you that your community could handle a cyberattack on its water system, and what would you want local officials to tell you first? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

• Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
• For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
• Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Copyright 2026 CyberGuy.com. All rights reserved.