Cyberattacks targeting water infrastructure have been reported across at least 12 U.S. states, with officials investigating possible links to Iran-backed hackers, according to sources familiar with the situation. The affected states include Minnesota, Michigan, Georgia, New Jersey, and South Dakota. In Minnesota alone, more than 30 community water systems were compromised, while Georgia’s Clayton County Water Authority—which provides service to 300,000 customers near Atlanta—experienced a drop in water pressure last month that necessitated a boil water advisory, though service was restored shortly thereafter.
The intrusions have caused some utilities to lose critical remote-control capabilities, requiring operators to shift to manual oversight. In various instances, unauthorized parties gained remote access to valves, pumps, and water pressure controls. Despite these disruptions, authorities emphasize that the safety of the drinking water supply has remained uncompromised throughout the incidents.
On July 30, a joint advisory from the FBI, the Environmental Protection Agency, and the Cybersecurity and Infrastructure Security Agency warned that threat actors had remotely accessed online systems in at least seven states, “resulting in a loss of monitoring and control functionality.” Federal agencies have advised water utilities to disconnect operating programs from the internet and bolster their firewalls and password security protocols.
While federal investigators suspect the involvement of Iran-backed hackers, no formal attribution has been issued. The methods observed in these attacks mirror a 2023 campaign attributed to the CyberAv3ngers, a group associated with the Iranian Revolutionary Guard, which exploited default passwords to infiltrate water-system controllers.
In Minnesota specifically, more than 30 community water systems were impacted, previously learned.
