Iran Suspected of Hacking US Water Systems in 7+ States
A wave of cyberattacks targeting municipal water systems across the United States has been traced back to Iran, according to two people familiar with the investigation. The attacks, which have affected at least seven states, have raised urgent questions about the security of America's critical infrastructure during an ongoing armed conflict.
The crisis began in late July when Minnesota reported that more than 30 of its state water systems had faced a coordinated cyberattack. The FBI subsequently warned that similar attacks had been reported in at least seven states, with some of the activity reportedly degrading water operations.
The Scope of the Attacks
The attacks have been far more widespread than initially reported. In addition to Minnesota, officials in New Jersey, South Dakota, and Georgia have confirmed that their water systems were targeted. The US Cybersecurity and Infrastructure Security Agency (CISA) is reportedly probing a possible Iranian connection to the attacks.
The compromised systems include everything from small rural water districts serving a few hundred people to major metropolitan water authorities serving millions. In several cases, the attackers gained access to operational technology systems that control water treatment, pressure regulation, and chemical dosing.
"This is not just a IT problem — this is an OT problem," said Morgan Wright, a former senior FBI cyber official. "When you're talking about water systems, you're talking about the ability to affect the water that millions of Americans drink every day."
The US has approximately 152,000 public drinking water systems and more than 16,000 wastewater treatment facilities, the vast majority of which operate with aging technology and limited cybersecurity resources.
How the Attacks Worked
According to cybersecurity experts who have analyzed the attacks, the hackers used a combination of techniques to gain access to the water systems. In many cases, they exploited known vulnerabilities in industrial control systems that had not been patched.
The primary hacking group suspected of carrying out the attacks is known as Handala, which US authorities have linked to Iran's Ministry of Intelligence and Security (MOIS). The group has been active since at least 2023 and has claimed responsibility for several previous attacks on US and Israeli infrastructure.
Handala's typical approach involves gaining initial access through phishing emails or by exploiting publicly exposed systems. Once inside a network, the group moves laterally to reach operational technology systems that control physical processes like water treatment and distribution.
Iran's Cyber Warfare Capabilities
Iran has developed significant cyber warfare capabilities over the past decade, driven in part by its desire to counter American military superiority in conventional warfare. The country's cyber forces have been involved in attacks against the US, Israel, Saudi Arabia, and other adversaries.
Most of the Iranian cyberattacks against the US and Israel this year have been carried out by Handala, according to BBC Verify. The group's activities have been attributed to Iran's intelligence services, which use cyber operations as a tool of statecraft.
The timing of the water system attacks is significant, coming amid the ongoing US-Iran conflict. Cybersecurity experts say Iran views cyberattacks against critical infrastructure as a way to impose costs on the United States without engaging in direct military confrontation.
"Iran knows it can't match the US in conventional warfare," said Jake Braun, former acting White House Deputy National Cyber Director. "So they're looking for asymmetric ways to strike back, and cyberattacks against critical infrastructure are one of the most effective tools they have."
The Threat to Public Health
While no one has been reported sick from contaminated water as a result of the attacks, cybersecurity experts warn that the potential consequences are severe. A successful attack on a water treatment facility could result in the distribution of improperly treated water, leading to outbreaks of waterborne diseases.
"The worst-case scenario is someone manipulating the chemical dosing at a water treatment plant," said Wright. "If you increase chlorine levels too much, you could poison people. If you decrease them too much, you could allow bacteria and viruses to pass through."
In a more extreme scenario, attackers could shut off water pressure in a distribution system, potentially causing backflow that draws contaminated water into the clean water supply. They could also damage pumps and other equipment, causing extended outages.
The EPA and CISA have jointly stated that cyberattacks pose a serious concern for water utilities and have recommended that systems be immediately removed from the internet where possible and have all passwords reset.
Government Response
The federal government's response to the attacks has been complicated by political dynamics. President Trump has not publicly blamed Iran for the hacks, instead attributing Minnesota's water issues to state officials including Governor Tim Walz.
Walz responded by saying that Trump knows exactly who is responsible for the attack and that other states were hit as well. The bipartisan nature of the affected states — spanning from deep-red South Dakota to blue New Jersey — has added a political dimension to the crisis.
CISA has recommended several immediate steps for water utilities, including disconnecting control systems from the internet, implementing multi-factor authentication, and conducting emergency security audits. However, many small water systems lack the resources and expertise to implement these measures quickly.
What You Can Do
For residents in affected areas, the immediate concern is whether their water is safe to drink. Officials have emphasized that no contaminated water has been distributed to consumers, but they recommend staying informed through local authorities.
Americans can take several steps to protect themselves and their communities. First, stay informed about your local water system's security status. Many utilities have begun publishing regular updates about their cybersecurity posture.
Second, support efforts to upgrade water infrastructure security. The water sector has been chronically underfunded, and cybersecurity investments are often the first things cut when budgets are tight. Contact your elected representatives to urge increased funding for water system security.
Finally, practice good cyber hygiene at home and at work. Many of the initial access points for these attacks come through simple phishing emails or weak passwords. By keeping your own systems secure, you help reduce the overall attack surface that hackers can exploit.
The Bigger Picture
The water system attacks are part of a broader pattern of Iranian cyber aggression against the United States. In recent months, Handala has claimed responsibility for attacks on healthcare systems, financial institutions, and government networks.
The attacks underscore the vulnerability of America's critical infrastructure to cyber threats. Despite years of warnings from cybersecurity experts, many essential systems — including water, power, and communications — remain inadequately protected.
As the US-Iran conflict continues, cybersecurity experts expect the frequency and sophistication of Iranian cyberattacks to increase. The water system attacks may be just the beginning of a sustained campaign against American infrastructure.
The lesson is clear: in the 21st century, national security extends far beyond traditional military capabilities. Protecting the digital systems that keep America running is just as important as maintaining a strong conventional military force.
What This Means for You
The developments covered in this article have real implications for everyday Americans. From your wallet to your safety, staying informed is the first step toward making smart decisions.
Bookmark WalterHennery.com and check back for updates as this story develops. We track the news that matters to you — no paywalls, no fluff, just clear reporting.