Iran-Linked Hackers Target 30+ Minnesota Water Systems

Authorities are investigating a coordinated cyberattack that targeted more than 30 community water systems in Minnesota over the weekend of July 26 and 27. U.S. and state officials believe Iranian-linked hackers are likely responsible, though the assessment remains preliminary. The FBI and Environmental Protection Agency (EPA) issued a joint warning Thursday that "malicious cyber actors" are targeting internet-facing operational technology used by U.S. water and wastewater utilities. The attackers targeted Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs), remotely changing IP addresses and passwords. This resulted in the loss of monitoring and control functions at affected facilities. Reported operational effects included pressure loss and flooding. In some cases, hackers locked out operators by changing passwords and disconnected equipment from networks, forcing some systems to switch to manual operation. At least one city asked residents to conserve water for several hours while officials worked to determine the scope of the problem. Minnesota IT Services confirmed Thursday that state officials have not yet identified the specific perpetrators behind the Sunday and Monday attacks. The FBI, which is leading the investigation, has not publicly named a culprit and a spokesperson declined to comment on who the bureau believes might be responsible. However, the FBI, Cybersecurity and Infrastructure Security Agency (CISA), and other agencies warned last week that Iranian hackers have been actively targeting water and wastewater systems as well as operational controls in other critical infrastructure sectors. The FBI and EPA urged utility operators to disconnect PLCs from direct internet exposure immediately. They also recommended strengthening authentication measures, strictly controlling network access, and maintaining the ability to operate systems manually in the event of cyber incidents. The agencies warned of a significant increase i