US Domestic — 2026-08-07

FBI Warns of Cyberattacks on US Water Systems in Seven States as Iran-Linked Actors Target Industrial Controls

BLUFWhite House resistance to Iran attribution leaves water utilities across seven states without the federal threat designation needed to unlock emergency hardening resources before the next intrusion wave.

The FBI and EPA issued a joint advisory Thursday stating that malicious cyber actors have targeted internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers at water and wastewater utilities in at least seven states since July 27, changing IP addresses and passwords and causing loss of monitoring and control functionality, with some incidents degrading operations including reported pressure loss and flooding; the advisory also flagged unauthorized modifications to PLC project files and ladder logic at affected sites and urged utilities to validate configurations against known-good baselines 1. NBC News reported the warning follows an attack on more than 30 Minnesota municipal water facilities with hallmarks of Iranian meddling, according to a law enforcement official, and that Michigan, Rapid City (South Dakota) and New Jersey also confirmed cyber incidents 23. The New York Times, cited by The Hill, reported federal authorities suspect Iran-linked hackers carried out the attacks, though officials have not made a definitive determination 3. President Trump on Friday attributed the incidents to Minnesota's state incompetence rather than Iran, drawing a rebuttal from Governor Tim Walz, while Minnesota's IT agency disputed Wisconsin's characterizations of pressure drops in its systems 2.

Analysis
FBI and EPA forensic detail on the Rockwell PLC targeting anchors moderate confidence in the technical characterization, but the advisory withheld attribution, and interagency forensic findings now pull against White House messaging blaming Minnesota's competence rather than Iran, leaving utilities uncertain whether to treat this as state-sponsored targeting or isolated negligence. Sourcing runs single-source at its technical core, with NBC, The Hill, and Axios amplifying rather than independently corroborating. Confirmed incidents in Michigan, Rapid City, and New Jersey have widened the cluster beyond Minnesota since the original advisory. Shared vulnerability may instead reflect common third-party integrator configurations rather than a coordinated campaign. Formal Iran attribution, if it lands, would hand CISA and utility regulators political cover to mandate PLC internet-exposure remediation and end-of-life replacement timelines nationwide; absent that, remediation stays voluntary and utility-by-utility.

4 sources

Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions - Federal Bureau of Investigation
Hackers targeted municipal water systems in 7 states this week, FBI says - NBC News
Iran-linked cyberattacks target U.S. water systems in multiple states - The Hill
Cyberattacks expose deeper vulnerabilities in U.S. water systems - Axios