Over 40 US water systems hit as FBI probes suspected Iranian cyber campaign

For cybersecurity professionals, these attacks on water systems underscore the escalating risk to operational technology (OT) environments. With over 40 systems impacted across two states, the incident demonstrates how internet-facing SCADA components can be exploited for disruptive or destructive purposes. The FBI's ongoing investigation and prior advisories linking Iranian groups to water sector targeting make this a critical threat intelligence case study.

A coordinated cyber campaign targeting water and wastewater systems in the United States has expanded to Michigan, with state officials confirming nine water facilities impacted following a federal cyber alert. This development comes days after Minnesota disclosed that over 30 of its water systems were similarly targeted, raising the total number of known incidents to at least 39 across the two states. The Federal Bureau of Investigation (FBI) is actively investigating the intrusions, while earlier joint advisories from the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and other agencies have explicitly warned that Iranian state-sponsored hackers are focusing on the water sector and other critical infrastructure. Despite the widespread nature of the attacks, authorities in both states have emphasized that no public health threats materialized and all systems continued to operate safely, though some localized service disruptions did occur.

“

In Minnesota, Minnesota IT Services reported over 30 affected systems, most involving remote monitoring and control equipment.

The incidents came to light after states received a federal cyber alert on Tuesday, July 28, 2026, about attempts to tamper with operational technology (OT) used to run water systems. In Michigan, Dale George, communications director for the Department of Environment, Great Lakes, and Energy (EGLE), said the state received a small number of reports from communities consistent with the federal warning, later confirming nine impacted systems. In Minnesota, Minnesota IT Services reported over 30 affected systems, most involving remote monitoring and control equipment. The city of Braham, about 70 miles north of Minneapolis, experienced a tangible operational impact: its water plant went offline for several hours on Monday, July 27, forcing the city of approximately 1,700 people to ask residents to minimize water use while the system relied on its water tower.

The timing and pattern align with a classified FBI-CISA advisory issued the previous week (week of July 20) that highlighted Iranian hackers' focus on water and wastewater systems. The advisory specifically warned that these actors—likely tied to Iran's Islamic Revolutionary Guard Corps (IRGC)—were exploiting internet-facing human-machine interfaces (HMIs), programmable logic controllers (PLCs), and other industrial control system (ICS) components. The attackers are believed to be using tactics such as brute-force attacks, default credential exploitation, and known vulnerability scanning to gain access and then manipulate system settings or cause disruptions. The FBI has not publicly attributed these recent breaches, but the advisory and the sophistication and scale of the incidents strongly suggest a nation-state actor.

For critical infrastructure operators, this campaign is a stark reminder that water systems—often underfunded and inadequately defended—remain a prime target. Many municipal water utilities rely on legacy SCADA systems with minimal network segmentation, lack multi-factor authentication, and have limited cybersecurity staffing. The Braham outage illustrates how a successful attack on OT controls can disrupt service, even if drinking water quality was not compromised. The broader scanning activity across dozens of systems indicates a systematic effort to identify and potentially preposition for future disruptive or destructive operations.