Cyber Threats to Municipal Water Systems Spark Nationwide Alert

Cyberattacks have targeted municipal water systems across seven states this week. This prompted the FBI and the Environmental Protection Agency (EPA) to issue warnings to utilities nationwide. Hackers aim to disrupt critical water infrastructure, and some malicious activities have already degraded operations.

In a public service announcement, the agencies indicated that incidents have been reported to the FBI. Although some attacks have affected operations, specific states impacted were not named. Law enforcement officials noted more than 30 municipal water facilities in Minnesota were targeted in an attack with potential links to Iran. Investigations are ongoing, but no water supply contamination has been observed.

The federal advisory highlighted targeted attacks on specific brands of control systems used by municipal water utilities. The FBI and EPA urge all operators to safeguard their systems. This warning underscores the vulnerability of U.S. infrastructure at a time of heightened conflict with Iran.

State officials reported a cyberattack on operating technology in over 30 Minnesota water systems, including Plymouth. Hackers accessed internet-facing devices, changed IP addresses and passwords, and disrupted monitoring and control capabilities.

The federal advisory recommends system operators secure programmable logical controllers (PLCs) behind gateways and firewalls, use strong passwords, and limit communication to authorized devices. No specific actor has been identified as responsible for these breaches.

Analyzing technical evidence alongside broader threat intelligence is necessary for attribution. The federal partners are leading the efforts in this analysis. Minnesota’s breach occurred shortly after a U.S. public warning about Iranian-backed cyber activities targeting infrastructure amid military tensions.

On July 22, federal agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), urged companies to bolster defenses against Tehran-linked hackers targeting online devices managing infrastructure.

U.S. intelligence agencies have warned that Iran is growing more capable and aggressive in cyber operations. Attempts to breach water systems have been noted in 2023.

Two years ago, the EPA highlighted that cyberattacks on water utilities were becoming more frequent. In May 2024, the agency reported that around 70% of inspected utilities had violated standards to prevent breaches.