Cyberattacks over July 28-29 hit roughly 30 water treatment facilities across Minnesota, targeting programmable logic controllers (PLCs) that manage treatment and distribution. Attackers reportedly changed operator passwords, locking staff out of remote monitoring systems and forcing several utilities to switch to manual operations; some communities issued temporary boil-water notices as a precaution.
The Cybersecurity and Infrastructure Security Agency (CISA) confirmed the activity "resulted in boil water notices and sustained manual operations," while U.S. intelligence officials say early forensic indicators point to Iranian state-linked hackers - though the attribution remains preliminary. The FBI is investigating but has not formally assigned responsibility.
No active water restrictions remain in Minnesota, but the incident marks one of the broadest disruptions of U.S. civilian infrastructure attributed to Iran-linked actors since tensions escalated earlier this year, and officials are examining whether related activity has hit utilities in other states.