In brief
Minnesota and six other states have reported a coordinated cyber‑attack on public water systems, with U.S. cyber‑security agencies suspecting Iranian involvement. The attacks did not shut down water supplies, but they discredited public trust and threatened critical infrastructure. Experts warn that attackers could deliver chemicals or disrupt services in the future. The U.S. is urged to overhaul aging systems and remove public utilities from the internet to safeguard national security.
Pentagon‑level cyber‑security officials are investigating whether a coordinated network of nation‑state actors, led by Tehran, disrupted water‑control software in seven U.S. states. Although the water supplies remained intact, the incidents undermined confidence in the public water system’s safety.
Is Iran Behind the Attacks?
Former state‑department advisers point to typical signatures found in North Korean and Iranian hacks. Political analysts note that the U.S. maintains a public war narrative against Iran, heightening the likelihood of attribution. However, the U.S. government has yet to publicly confirm the image.
Pattern of Iranian Cyber‑Attacks
Agents linked to Iran’s intelligence agencies have a documented history of infiltrating U.S. civilian networks. The so‑called Handala group, identified by U.S. authorities, has carried out a series of operations from 2016 to 2024, including surveillance of U.S. political leaders and attacks on water infrastructure.
- 2026: U.S. Justice Department disrupted a Handala operation targeting a medical‑technology firm, exposing sensitive data on Israeli officials.
2024: Handala indicted for infiltrating U.S. presidential campaigns to spread distrust, gathering confidential staff data.- 2023: Water & wastewater systems in Pennsylvania were altered by a group tied to Iran’s Revolutionary Guard Corps.
2020: Two Iranian nationals faced charges over targeted U.S. voter data theft during the presidential election.
2017: A ransomware campaign impacted local U.S. governments and health institutions, though not officially sanctioned by Iran.
Could It Endanger Water Supplies?
The primary threat to U.S. water infrastructure is the erosion of public confidence, experts argue. Still, potential sabotage—such as chemical contamination or abrupt shut‑offs—poses a serious risk if adversaries gain deeper access.
Preventive Measures
Cyber‑security providers emphasize the need to upgrade aging hardware and isolate water‑control networks from the public internet. CISA recommends immediate de‑internetisation of SCADA systems, password resets, and the deployment of hardened, modern PLCs.
CISA’s advisory outlines critical steps water utilities should take to mitigate cyber‑threats.
— Shayan Sardarizadeh, BBC Verify
