What we know about the alleged Iranian hacks on US water utilities

A wave of cyberattacks has hit water utilities across the U.S. since late July, prompting alarm even though water systems and other critical infrastructure have long been targeted by hackers, government-backed or otherwise. What makes this campaign — allegedly carried out by Iran — particularly concerning is how widespread it was, hitting targets in around a dozen states. Cybersecurity experts have long believed Iranian hackers went after low-hanging fruit in isolated, opportunistic attacks, so a campaign this coordinated could mark a significant escalation.

On July 28, Minnesota authorities said water treatment plants in more than 30 communities had been hit by coordinated cyberattacks. Two days later, the FBI said water and wastewater utilities in at least seven states had reported incidents, some of which degraded water operations — including a loss of pressure that could potentially let untreated groundwater seep into pipes, and flooding. Beyond Minnesota, hacks have since been reported in Arkansas, Georgia, New Jersey, and Michigan; the town of Braham, Minnesota took its water plant offline for a few hours and asked its roughly 1,700 residents to conserve water, while a Georgia county outside Atlanta told residents to boil water as a precaution.

No one has officially named a culprit, but the top suspect is the Iranian government. The first Minnesota incidents came days after the Cybersecurity and Infrastructure Security Agency updated an April warning that Iranian hackers were targeting internet-connected devices in water systems and the energy sector. After the attacks, President Trump said he did not think “there was an Iranian cyberattack” and blamed the state instead — a day after Wired reported that the Water Information Sharing and Analysis Center had told members the attacks aligned with CISA’s warning. This week, the Washington Post reported that U.S. intelligence agencies are confident Iran, specifically the Islamic Revolutionary Guard Corps, is responsible, though the attribution isn’t public because officials are unsure which IRGC unit was involved, and may be reluctant to contradict Trump.

Cybersecurity firm Forescout reported finding more than 2,800 water-system controllers exposed to the internet earlier this month, out of more than 150,000 water systems nationwide — exposure that doesn’t guarantee hackers can seize control, though it has happened in isolated recent cases. Perhaps the most significant effect so far has been psychological: the widely covered attacks have left people worried about the safety of a basic need, which may be exactly what the hackers intended.

Why it matters

The campaign highlights how exposed America’s fragmented, resource-strapped water systems are to attackers who have historically relied on low-hanging fruit — and how, amid an active geopolitical conflict, attribution can become as much a political question as a technical one.