FBI probes 39+ water system cyberattacks across Michigan, Minnesota

The latest wave of cyberattacks on U.S. water utilities is a chilling escalation in the targeting of operational technology, as adversaries move beyond IT disruption to directly fiddle with the systems that keep communities safe. With over 39 water systems in Minnesota and Michigan reporting intrusions in a single week, and an FBI advisory pointing to Iranian hackers, the incidents signal that the water sector is now a proving ground for state-sponsored groups testing America's critical infrastructure resilience. For CISOs and security engineers, the message is clear: the convergence of IT and OT in under-resourced utilities has opened a new front that demands immediate attention.

A cascading cyberattack has struck critical water infrastructure across two U.S. states, prompting an FBI investigation and elevating concerns over state-sponsored threats to operational technology (OT). In late July 2026, over 30 water systems in Minnesota were compromised, and Michigan subsequently confirmed nine additional systems affected by similar activity. No public health or safety impacts were reported—all systems continued safe operation—but the incidents underscore the fragility of the water and wastewater (WWS) sector and the growing sophistication of adversaries targeting industrial control systems.

“

states, prompting an FBI investigation and elevating concerns over state-sponsored threats to operational technology (OT).

The attacks in Minnesota were first disclosed earlier the week of July 27, with officials reporting that the cyber intrusion targeted OT at more than 30 water utilities across the state, including the city of Plymouth. Within days, Michigan's Department of Environment, Great Lakes, and Energy (EGLE) revealed it had received a federal cyber alert on Tuesday, July 28, warning of attempts to tamper with operational technology at water systems. “Soon after” the alert, Michigan received a “small number of reports from Michigan communities indicating activity consistent with what federal agencies described,” according to EGLE communications director Dale George. Nine systems were ultimately flagged, though all continued to function normally and posed no known public health risk.

The timing of the incidents dovetails with a joint advisory from the FBI, CISA, and other agencies issued the previous week, which warned that Iranian hackers have been actively targeting water and wastewater systems and the operational controls of other critical infrastructure sectors. While the FBI has not publicly attributed the Minnesota or Michigan attacks to any specific actor, the advisory suggests a possible link to an ongoing campaign by Iranian state-sponsored groups, which have historically probed U.S. critical infrastructure. The Bureau stated on August 1 that it is “fully engaged to protect critical infrastructure” and remains “well-equipped to protect against cyber threats of all varieties,” but declined to identify a suspect.

The WWS sector has long been recognized as a weak link in national cybersecurity. Many water utilities are small, underfunded, and rely on legacy OT/SCADA systems with minimal segmentation from IT networks. The 2021 Oldsmar, Florida water treatment plant incident, where a hacker attempted to raise sodium hydroxide levels to dangerous concentrations, demonstrated the potential for catastrophic harm. The current incidents, while reportedly non-disruptive, reveal a coordinated, multi-state operation that may have been intended to test defenses, gather intelligence, or establish persistent access for future disruption.

For the cybersecurity community, the attacks highlight several key trends. First, the targeting of OT—rather than purely IT systems—signals an escalation in adversary capabilities and a willingness to cross a red line by meddling with processes that directly affect public health and safety. Second, the rapid spread across states, likely leveraging common vulnerabilities in remote access tools or internet-facing HMIs, points to systemic weaknesses that extend beyond any single utility. Third, the parallel between the advisories and the incidents reinforces the value of threat intelligence sharing; however, the fact that attacks occurred after alerts were issued suggests that many utilities were unable to implement mitigations in time.