Cyberattack Hits 30 Minnesota Water Systems, Officials Suspect Iran Link

More than 30 community water systems in Minnesota were hit in a coordinated cyberattack over the weekend, state officials said, and federal agencies on Thursday urged water utilities across the country to cut exposed control equipment off the internet. Minnesota IT Services, the state technology agency, called it a coordinated attack, Reuters reported. Officials have found no sign that drinking water was made unsafe.

The intrusions occurred on Sunday and Monday, according to the state and to a water-sector information-sharing memo described by Nextgov. Attackers targeted programmable logic controllers, the small industrial computers that run pumps, valves and treatment equipment, and in some cases changed passwords to lock operators out, according to the Cybersecurity and Infrastructure Security Agency, or CISA. In Braham, an intrusion briefly knocked out controls for the city’s well and treatment plant, Nextgov reported. Some utilities had to run equipment by hand. CISA said the activity “has resulted in boil water notices and sustained manual operations.” The state agency told ABC News that “impacted” means investigators confirmed malicious activity, not that every community lost service, and that no Minnesota locality has asked residents to change their water use.

Who is responsible is not settled. The New York Times reported Thursday, citing unnamed state and federal officials, that the government believes Iranian hackers were likely behind the attack. Those officials told the Times they had not definitively identified the culprits. Emily Zimmer, a spokesperson for the state agency, told Reuters the timing, access methods and targets resemble other coordinated attacks on critical infrastructure that federal partners have observed. A water-sector memo said the attacks were “aligned” with an Iran-linked campaign CISA described in April, but it presented no direct evidence tying this incident to Iran, according to Nextgov. The FBI said it was “actively engaged with victims,” according to Reuters, and ABC News reported that it has not assigned responsibility.

The attack comes while the U.S. and Iran are again exchanging fire. The United States joined Israel in a war against Iran that began on Feb. 28, and a June agreement that paused fighting broke down this month, Reuters noted. Suspected Iran-linked hackers have been blamed for earlier intrusions into U.S. industrial systems since the war began, Nextgov reported, including a disruption at the medical technology company Stryker.

CISA’s alert on Thursday warned that unnamed hackers are increasingly going after internet-connected controllers in water and wastewater systems. It urged utilities of all sizes to disconnect exposed equipment, replace default passwords and limit remote access to trusted devices, and, where remote access is needed, to use a VPN or gateway device, according to Nextgov and ABC News. John Israel, Minnesota’s chief information security officer, told ABC News that the state shared relevant information with the federal government, which is working to determine whether a specific threat actor is responsible.

The weakness is structural. Water utilities, especially small ones, often run aging equipment maintained by several contractors over decades, Aurigo Software’s chief information security officer, Manish Sharma, told Nextgov, which makes them hard to defend.