Photo: seksan Mongkhonkhamsao / Moment / Getty Images
Cyberattacks have struck municipal water systems in at least seven states this week, according to a new warning issued by the Federal Bureau of Investigation (FBI) and the Environmental Protection Agency (EPA). The agencies, in a public service announcement on Thursday (July 30), said hackers targeted water and wastewater utilities, in some cases disrupting operations and degrading the ability to manage water supplies. The specific states affected have not been named.
The announcement follows a coordinated cyberattack that disrupted more than 30 water facilities in Minnesota. In the Minnesota incident, utilities in communities such as Braham and Plymouth experienced outages, but officials confirmed that water quality was not compromised and there was no need for the public to adjust consumption. Minnesota's technology agency responded by sharing threat intelligence and coordinating with state and federal partners, including the Cybersecurity and Infrastructure Security Agency (CISA).
The FBI and EPA have not identified those responsible for the attacks. However, the warning comes amid heightened concerns about Iranian-linked hacking groups targeting U.S. critical infrastructure. In previous advisories, federal agencies urged water utilities to strengthen cybersecurity, remove programmable logic controllers (PLCs) from direct internet access, and improve password security.
In Minnesota, President Donald Trump commented on the attacks, blaming state leadership and Governor Tim Walz, while downplaying Iran's involvement. Minnesota officials did not respond to these remarks.
Cybersecurity experts warn that U.S. water utilities are particularly vulnerable due to the large number of small, rural systems and outdated infrastructure. A 2024 audit by the EPA found more than 70% of inspected water systems had not met required cybersecurity standards. Experts also note that advances in artificial intelligence could allow attackers to create more sophisticated attack plans against underprepared utilities.
The FBI and EPA advise all water utilities to remain vigilant, improve defenses, and follow best practices to prevent future attacks. The investigation into the source of the cyberattacks is ongoing.