Cyberattacks on municipal water systems were reported in at least seven states this week, according to a joint public service announcement from the FBI and the Environmental Protection Agency – and in some cases, the agencies say, the malicious activity actually degraded water operations. The feds declined to name the states.
The warning lands just days after we reported that a “coordinated cyberattack” struck more than 30 community water systems in Minnesota over July 26-27 – knocking the water plant in tiny Braham offline for a stretch, pushing Plymouth and South St. Paul onto manual operations, and prompting Maple Plain to declare a local state of emergency, according to Just The News.
The playbook, per federal officials, was crude but effective: attackers remotely accessed internet-facing operational technology, changed device IP addresses and passwords, and locked utility operators out of their own monitoring and control systems, NBC News reported. The PSA is now pleading with utilities to do the bare minimum – pull programmable logic controllers off the open internet and put them behind gateways and firewalls, use actual passwords, and restrict which devices are allowed to talk to one another.
(Yes – in the year 2026, a nontrivial share of the machines controlling America’s drinking water are still sitting on the public internet, some with absurdly simple passwords.)
CISA followed Thursday with an advisory warning that Iranian-affiliated actors are going after U.S. critical infrastructure, water and wastewater systems included – an update to guidance the agency first pushed out in April, which we flagged in our earlier coverage. Some of the larger water-sector intrusions, the advisory notes, have produced boil-water notices and left plants grinding along in manual mode for extended stretches. CISA’s top-line fix is the same one it has been repeating for years: cut direct internet access to control systems.
Except – Washington can’t agree on who did it.
Multiple U.S. officials have told ABC News the Minnesota attacks may be linked to Iran, and investigators’ preliminary assessment reportedly leans the same way – with the caveat that it could change. Meanwhile President Trump denied it. Speaking to reporters at Camp David on Friday, Trump dismissed the Iran theory – “Iran should be so lucky,“ he said – and instead pinned the blame on what he called Minnesota’s grossly incompetent and corrupt leadership under Gov. Tim Walz, arguing Tehran has bigger problems than the Gopher State’s pump stations.
Trump:
They like to say, “Ohh, it’s Iran. Iran should be so lucky.”
Iran’s got bigger problems than worrying about Minnesota. https://t.co/4FnVLLzSmY pic.twitter.com/9HMP4RTcii
— Adam Scott (@chefcascottccc) July 31, 2026
Cybersecurity veteran Morgan Wright, founder of the National Center for Open and Unsolved Cases, told The Hill that Iran is the likely culprit, pointing to the CISA advisory as one tell. The U.S. may dominate on land and at sea, Wright argued, but cyberspace is the one domain where Tehran gets to punch above its weight class. Federal officials, for their part, caution that attribution requires careful technical analysis alongside broader threat intelligence – because otherwise it looks like the same nakedly transparent propaganda we’ve been fed for decades (duh).
That said – there is precedent as we detailed in our Minnesota coverage, if we’re to believe the official stories. In November 2023, the IRGC-linked CyberAv3ngers seized control of a device at the Municipal Water Authority of Aliquippa, Pennsylvania. In early 2024, the Cyber Army of Russia Reborn claimed attacks on water facilities in the U.S. and Poland, including a breach in Muleshoe, Texas that dumped tens of thousands of gallons of water. In October 2024, American Water – the largest regulated water utility in the country, serving more than 14 million people across 14 states and 18 military installations – shut down computer systems after a cyberattack. Beijing’s Volt Typhoon has spent years quietly pre-positioning inside U.S. critical-infrastructure networks, per CISA. And just weeks ago, the Iranian MOIS-linked Handala persona claimed to have compromised California Water Service – which serves roughly 2 million customers – leaking 5 gigabytes of data, then vowed via Tehran’s Press TV to keep hitting U.S. industrial control systems.
