A preliminary analysis by U.S. investigators suggests that Iranian hackers were likely responsible for a cyberattack targeting multiple municipal water systems in Minnesota. The attack occurred this week and is viewed as a potential escalation related to ongoing tensions stemming from the war.
The security firm Tenable, which is investigating approximately 30 cyberattacks on water management infrastructure from Sunday to Monday, refrained from definitively attributing the attack to any specific group. However, it indicated that the attack patterns resembled those of the group known as 'CyberAv3ngers,' which the U.S. government identifies as a front for the Islamic Revolutionary Guard Corps Cyber-Electronic Command. The attacks specifically targeted automated systems and computer controls at wells and treatment plants.
Despite the attacks, the quality of the water supplies remained unaffected. The most significant incident involved the 1,700-member community of Braham, where the computerized controls for the well and water treatment plant were disabled for about two hours. The city of Plymouth disconnected cellular-connected equipment at two water towers and several wastewater stations as a precaution, reverting to manual procedures. In South St. Paul, some automated controls were compromised, while Maple Plain declared a local state of emergency in response to a similar attack.
Tenable highlighted the timing of the attack, which followed an advisory issued four days earlier warning that Iranian-affiliated actors had been compromising internet-connected programmable logic controllers (PLCs) across U.S. water, energy, and government sectors, leading to confirmed disruptions and financial losses.
U.S. and state officials informed the New York Times that the attribution to Iranian hackers remains preliminary. In Braham, the cyberattacks have become a topic in local political campaigns, with Mayor Nate George, a Republican candidate for Minnesota state auditor, emphasizing the need for investment in local government to protect critical infrastructure. He stated that the attack should serve as a warning to policymakers about the vulnerabilities faced by local governments in defending essential systems against foreign adversaries and sophisticated criminals.
George noted that Braham's preparedness, including strong internal controls and swift responses from city employees, helped to contain the attack without disrupting water service. U.S. water systems are increasingly targeted by foreign-affiliated hackers due to outdated cybersecurity measures.