The federal government on Thursday issued an alert after cyberattacks hit 30 Minnesota water plants, with officials saying the intrusions may be linked to Iran. CISA reported attackers targeted PLCs and changed passwords, locking out operators and prompting boil-water notices and manual operations in some areas. MNIT said not every community lost service and no public water-use restrictions are currently active. Federal and state forensics and investigations are ongoing, and the FBI is aware but has not attributed responsibility.
Federal Alert After Cyberattacks Disrupt 30 Minnesota Water Plants; Investigation Underway
Stock Image/Getty Images - PHOTO: In this undated file photo, a water tower is shown in Minnesota.
The federal government on Thursday warned water utilities nationwide after 30 water plants in Minnesota were hit by cyberattacks that U.S. officials told ABC News may be linked to Iran. The Cybersecurity and Infrastructure Security Agency (CISA) said the incidents targeted programmable logic controllers (PLCs) and included password changes that temporarily locked out operators.
Scope and Immediate Impact
CISA said the activity "has resulted in boil water notices and sustained manual operations" in some communities. Minnesota IT Services (MNIT) clarified that an "impacted" designation means investigators confirmed malicious activity involving a system's technology, but it does not necessarily mean every affected community experienced a service disruption.
What Officials Are Saying
"We have provided relevant information to the federal government, which is evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor," said John Israel, Minnesota's chief information security officer.
Federal and state authorities are investigating whether Iran or actors associated with Iran were behind the attacks, according to multiple U.S. officials who spoke with ABC News. Officials stressed the analysis is preliminary and that the U.S. has not made any formal attribution.
STOCK PHOTO/Getty Images - PHOTO: An undated stock photo depicts an unidentified person typing on a computer keyboard.
Forensics and Ongoing Investigation
Investigators are awaiting more detailed forensic results to determine how the intrusions occurred, the full scope of affected systems, and whether similar intrusions in other states share the same tools or actors. The New York Times first reported on Thursday that probes were examining potential Iran-linked activity.
Federal Guidance and Utility Precautions
CISA urged water utilities to harden defenses: disconnect PLCs from direct internet exposure where possible, and if remote access is required use a VPN or a secure gateway device. Utilities were also advised to review access logs, change and protect passwords, and ensure incident response plans are current.
Law Enforcement Response
The FBI said it is aware of the intrusions but has not assigned responsibility. State and federal agencies continue to coordinate on forensic analysis and information-sharing to identify the attackers and mitigate ongoing risks.
Bottom line: Authorities are investigating a coordinated cyber incident affecting Minnesota water systems that disrupted operations in some places. For now, officials emphasize that attribution remains preliminary and that utilities should adopt CISA's recommended mitigations while forensics continue.
Help us improve.
