Cyberattacks Reported on Water Systems in at Least Seven US States; FBI Probing Possible Iranian Role
The Facts
- Federal agencies say water systems in at least seven US states were affected by malicious cyber activity, but have not publicly identified all of the states involved.
- A joint FBI and Environmental Protection Agency notice said that since July 27, 2026, cyber activity targeting water and wastewater utilities had negatively affected operations at some facilities.
- Minnesota was the first state to publicly report the incidents, saying more than 30 of its community water systems were targeted.
- Michigan reported on Saturday that nine of its water systems were affected, after receiving a federal cyber alert on Tuesday about attempts to tamper with operational technology at water facilities; a state environment department spokesperson said all systems were operating safely and that local operators had resolved the problems.
- Officials say there is no indication that any water supply was altered or made unsafe to drink, and no damage or injuries have been reported.
- Some affected utilities issued boil-water notices or switched to manual operations as a precaution, according to the Cybersecurity and Infrastructure Security Agency.
- Investigators are examining whether Iranian hackers were responsible but have not definitively attributed the activity; the FBI said it had not determined who was behind the incidents and that agencies were engaged in protecting critical infrastructure.
- President Donald Trump publicly rejected the assessment that Iran was responsible, saying at a Cabinet meeting at Camp David that he blamed Minnesota's state government and Governor Tim Walz instead; he did not say who he believed carried out the attacks.
- The incidents follow federal warnings issued in July that Iranian-linked hackers were exploiting internet-exposed programmable logic controllers used to run water, wastewater and energy facilities.
Context
What equipment did the attackers target, and why does it matter?
Reporting points to programmable logic controllers (PLCs) — industrial computers used to monitor and adjust functions such as chemical-treatment levels and water pressure 경향신문,Straits Times. Federal cybersecurity officials warned in July that Iranian hackers had been targeting internet-exposed devices of this kind at water, wastewater and energy facilities NZ Herald. Because these controllers govern basic treatment and distribution functions, tampering can force operators to run plants manually or issue precautionary boil-water notices infobae,CBS News.
Has Iran been formally blamed?
No. US officials and sources told CBS News that investigators are probing a possible Iranian link but cautioned that the assessment could change as more technical evidence is collected CBS News. Intelligence agencies have not definitively concluded that Tehran was responsible, and the FBI declined to say whether it believed Iran was behind the incidents NZ Herald,Detroit Free Press.
Is drinking water in the affected states safe?
State and federal officials say there is no evidence any water supply was altered or made unsafe elcolombiano.com,Straits Times. Michigan's environment department said no known effects posed a threat to public health and that all systems continued to operate safely Independent,RP Online. Some utilities nonetheless issued boil-water notices as a precaution, and officials across the country said they remained on alert for further intrusions infobae,Straits Times.
Where Left and Right agree, and where they split
- Where Left and Right agree
- Hostile actors reached the operational technology of water utilities in at least seven states, local operators contained it without harm to supplies, and attribution remains unproven.
- Where Left and Right split
- Local utility crews absorbing the risk while officials assign blame, or foreign hands on American pumps demanding a sovereignty-level answer.
How left and right read it
More than 30 Minnesota community water systems were targeted, nine in Michigan, and at least seven states affected in all. Local operators fixed the problems, some flipping to manual operation or issuing boil-water notices — public utilities absorbing the risk while attribution remains unsettled. Investigators are even weighing whether the actor merely posed as Iran-based. Blaming a governor is not infrastructure defense. Evidence first, then names.
“They are also probing whether the actor could have attempted to appear Iran-based as a way of stirring the pot amid the ongoing U.S. conflict with Iran.” — CBS News
Since late July, hostile actors reached into the operational technology running water and wastewater utilities in at least seven states — more than 30 Minnesota systems targeted, nine in Michigan, some plants reverting to manual control. Foreign hands on American pumps and valves is a sovereignty question, not an IT ticket. A local mayor is saying out loud what officials will not. Harden these systems, and speak plainly about who is probing them.
“Braham mayor Nate George told the New York Times Friday afternoon that federal and local officials had little doubt about the likely culprit being Iran, but are reluctant to say so publicly.” — Washington Examiner
The receipts — all 75 sources
Wire services (1)
Independent coverage (50)
Facts first. Then every angle.
The day’s biggest stories in one short brief — the facts everyone agrees on, then the competing values behind the headlines. Free in your inbox.