The FBI has reported cyberattacks targeting municipal water systems in at least seven states this week, prompting warnings from both the FBI and the Environmental Protection Agency (EPA) to utilities across the country. The agencies noted that water and wastewater utilities have reported incidents, with some activities affecting water operations. The specific states involved have not been disclosed.
This warning follows an attack on over 30 municipal water facilities in Minnesota, which has been linked to potential Iranian involvement, according to a law enforcement official. Investigations are ongoing, and a spokesperson for Minnesota's information technology services agency stated that there is no evidence that the breaches contaminated municipal water supplies.
The Cybersecurity and Infrastructure Security Agency (CISA) indicated that some attacks on water infrastructure have led to boil water notices and manual operations, although details on the locations were not provided. The FBI and EPA have not publicly identified any suspects in the incidents across the states.
President Donald Trump commented on the situation, criticizing Minnesota's leadership and suggesting that the state was responsible for the attack. In response, Minnesota Governor Tim Walz stated that Trump is aware of the broader implications of the cyberattacks and emphasized the need for a strategic response to such threats.
The federal advisory focused on the tactics used in the attacks rather than attribution. It highlighted that malicious cyber actors targeted specific brands of control systems used by municipal water utilities and urged all operators to enhance their security measures. The Wisconsin Department of Natural Resources issued a bulletin indicating that their systems might be vulnerable to similar attacks, although they have not confirmed any breaches.
The advisory from federal agencies recommended that system operators secure programmable logic controllers (PLCs) by placing them behind secure gateways and firewalls, using strong passwords, and limiting communications between authorized devices.
This breach in Minnesota occurred shortly after U.S. officials warned that Iran-backed hackers were targeting critical infrastructure amid rising tensions between the U.S. and Iran. U.S. intelligence agencies have noted that Iran is increasingly capable of executing aggressive cyber operations, having attempted to target water systems in 2023. Cybersecurity expert Bryson Bort emphasized the importance of public awareness regarding the risks associated with infrastructure breaches.