Article By Frank Bergman
A coordinated cyberattack has targeted more than 30 community water systems in Minnesota, raising fresh alarms over the growing threat to America’s critical infrastructure as Iran-linked hackers openly warn that U.S. utilities remain in their crosshairs.
Minnesota officials confirmed that multiple water systems were compromised during attacks on July 26 and July 27, while investigators continue working to determine who was responsible.
Although authorities have not yet attributed the attacks to a specific group, the incidents come just days after an Iranian-linked hacking operation threatened to escalate attacks against U.S. water, electricity, and transportation networks.
More Than 30 Water Systems Targeted
Minnesota IT Services (MNIT) said it activated its incident response team immediately after discovering the coordinated attack.
Investigators are continuing to assess the affected systems, but officials said they are not currently asking residents to alter their drinking water usage.
John Israel, Minnesota’s chief information security officer, warned that attacks against critical infrastructure demand a broad government response.
“[The agency] is working side by side with our partners to share intelligence, support affected communities, and help utilities restore operations safely while strengthening defenses against future attacks,” Israel said.
Agency spokeswoman Emily Zimmer said investigators determined there had been unauthorized access carried out with malicious intent.
She added that while attribution remains under investigation, the attacks share characteristics with other coordinated cyber incidents involving critical infrastructure that federal authorities have previously observed.
The FBI confirmed it is working with affected utilities as the investigation continues.
Iran-Linked Hackers Threaten Wider Campaign Against U.S. Infrastructure
The attacks occurred only days after Iran’s state-run Press TV reported that the hacking group Handala had vowed to continue targeting American industrial control systems.
According to the U.S. Department of Justice, Handala is one of several public fronts used by hackers operating under Iran’s Ministry of Intelligence and Security as part of its psychological operations.
Press TV reported that Handala warned recent attacks on industrial control systems represented only a fraction of its capabilities and said future operations could target water systems, electrical grids, and transportation infrastructure across the United States.
Federal cybersecurity officials have repeatedly warned that Iranian hackers are actively probing internet-connected industrial control equipment used throughout America’s critical infrastructure.
Federal Agencies Warn Threat Is Expanding
Earlier this year, the Cybersecurity and Infrastructure Security Agency (CISA) expanded an existing advisory warning that Iran-linked hackers were targeting programmable logic controllers manufactured by multiple companies, including Rockwell Automation, Schneider Electric, and Siemens.
CISA said some of the activity resembles operations previously attributed to CyberAv3ngers, also known as the Shahid Kaveh Group, which is affiliated with the Cyber Electronic Command of Iran’s Islamic Revolutionary Guard Corps.
Acting CISA Director Nick Andersen said the agency is coordinating with the Environmental Protection Agency and other partners after learning of multiple potential incidents affecting local water utilities.
“CISA is aware of multiple potential incidents affecting local water utilities and is coordinating with the EPA and other government and industry partners to understand the scope and provide any information or technical support to help critical infrastructure owners and operators protect their systems,” Andersen said.
Cybersecurity firm Dataminr separately warned that Handala recently claimed responsibility for compromising California Water Service, one of the nation’s largest investor-owned water utilities serving approximately 2 million customers.
The hackers reportedly published 5 gigabytes of stolen data.
“CISA’s updated reporting shows a worrying expansion in Iran-linked critical infrastructure targeting focused on the United States,” Dataminr Director of Threat Research and Cyber Engineering Joe Slowik said.
America’s Water Infrastructure Faces Mounting Cyber Threats
Microsoft recently warned that cyberattacks against water utilities present unique dangers because hackers who breach digital networks can potentially gain access to physical infrastructure, including pumps, sensors, and chemical treatment systems.
The company noted that America’s water utilities are particularly vulnerable because the overwhelming majority are small operations with limited cybersecurity resources.
According to the Environmental Protection Agency, 97 percent of the nation’s approximately 156,000 public water systems serve fewer than 10,000 customers.
The latest Minnesota attack follows a string of high-profile cyber incidents targeting U.S. water infrastructure in recent years.
Iran-linked CyberAv3ngers hackers seized control of equipment at a Pennsylvania municipal water authority in 2023.
American Water, the nation’s largest regulated water and wastewater utility, shut down computer systems after a cyberattack in 2024.
Russian hackers have also claimed responsibility for attacks on U.S. water facilities, while intelligence agencies have warned that the Chinese Communist Party-backed Volt Typhoon hacking group has been positioning itself inside American infrastructure networks for potential future disruption.
According to the U.S. Intelligence Community, China remains “the most active and persistent cyber threat” facing American institutions.
With foreign adversaries increasingly targeting the systems that supply Americans with drinking water, federal officials continue warning that the battle over U.S. critical infrastructure has already moved into cyberspace.
Be the first to comment