WASHINGTON—U.S. federal authorities are investigating a series of cyber intrusions targeting drinking water and wastewater systems across multiple states, with officials warning that the activity is consistent with ongoing campaigns by Iranian-affiliated cyber actors against critical infrastructure, though investigators have not formally attributed the incidents to a specific group.
The Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (CISA), the Environmental Protection Agency (EPA), the National Security Agency and other federal partners have urged utilities to strengthen cybersecurity measures after attacks disrupted operational technology used to manage water systems. The agencies said the activity has affected internet-connected industrial control equipment, including programmable logic controllers used to operate treatment facilities.
Federal officials said the attacks have caused operational disruptions at some facilities but stressed there is no evidence that drinking water quality has been compromised. Utilities have been advised to disconnect vulnerable operational technology from the public internet where possible, review system logs for signs of compromise and report suspicious activity to federal authorities.
The warnings follow reports of cyber incidents affecting water utilities in states including Minnesota and Michigan. Minnesota officials said more than 30 community water systems were targeted, while Michigan reported attacks involving nine water systems. State and local officials said affected facilities continued to provide safe drinking water despite temporary operational disruptions at some locations.
The FBI said it is investigating the incidents alongside other federal agencies. Although U.S. officials have pointed to similarities between the attacks and previous activity linked to Iranian cyber operators, authorities have not publicly issued a formal attribution for the latest campaign.
A joint federal cybersecurity advisory issued earlier this year warned that Iranian-affiliated actors were exploiting internet-exposed operational technology across several critical infrastructure sectors, including water and wastewater systems. The advisory said attackers had manipulated engineering software, altered controller configurations and disrupted human-machine interfaces, resulting in operational interruptions and financial losses.
The incidents have also drawn political attention. President Donald Trump has publicly questioned whether Iran was responsible for attacks affecting Minnesota's water systems, while Minnesota Governor Tim Walz said state and federal officials were treating the incidents as part of a broader campaign against critical infrastructure. Federal investigators have continued to emphasize that the inquiry remains active and that no final public attribution has been announced.
