Multiple US States' Water Supply Systems Targeted in Cyber Attacks, Suspected Involvement of Iranian Hackers

In the past two weeks, water supply facilities across multiple locations in the United States have been subjected to cyber attacks, escalating the issue from local to federal concern. Public information indicates that affected entities include water treatment plants and sewage treatment companies, spanning over a dozen states. The FBI reported that some attacks have led to operational issues such as reduced water pressure and localized flooding.

Scope of Attacks Expands to Multiple States
The initial widespread concern arose from Minnesota. On July 28, local authorities reported that water treatment facilities in over 30 communities experienced coordinated attacks. Two days later, the FBI stated that at least seven states reported incidents related to water supply and sewage treatment facilities, with some operations affected.

Subsequently, reports of facility breaches emerged from Arkansas, Georgia, New Jersey, and Michigan. Reports indicate that there are over 150,000 water supply systems nationwide in the U.S., many of which are operated by local agencies or small companies. This decentralized structure, while making unified attacks more challenging, also means that some operators lack sufficient cybersecurity resources.

US Government Has Not Officially Attributed the Attacks
Currently, the U.S. government has not officially named the attackers. However, multiple agencies and media outlets have pointed suspicion towards Iran.
The Cybersecurity and Infrastructure Security Agency (CISA) updated a warning prior to the Minnesota incident, stating that Iranian hackers were targeting internet-connected water systems and energy facilities. Subsequently, the Water Information Sharing and Analysis Center (WaterISAC) informed its members that the recent attacks were consistent with the characteristics warned by CISA.

The Washington Post reported this week, citing informed sources, that U.S. intelligence agencies are "confident" that Iran, particularly the Islamic Revolutionary Guard Corps, is responsible for this wave of attacks. However, due to the lack of confirmation of specific executing units and inconsistencies with statements from the White House, the attribution remains undisclosed.

Some Facilities Temporarily Shut Down
From the disclosed information, this wave of attacks has not all resulted in severe consequences, but there have been tangible impacts. Earlier this month, cybersecurity firm Forescout reported finding over 2,800 controllers exposed to the public internet within U.S. water supply systems. Once exposed, these devices may not be completely taken over but significantly increase the risk of being compromised.

The FBI stated that some attacks led to reduced water pressure, which theoretically could allow untreated groundwater to seep into the pipes, and there have been instances of localized flooding. A water plant in Braham, Minnesota, was temporarily shut down for several hours, prompting approximately 1,700 residents to conserve water. The city of Maple Plain briefly declared a state of emergency. A county near Atlanta, Georgia, also advised residents to boil water before use.

Beyond operational impacts, the social implications of the incident are also significant. Water supply systems are essential public infrastructure, and the continuous attacks have raised public concerns about drinking water safety after being amplified by local and national media. Reports suggest that this panic may itself be one of the effects the attackers hoped to create.