The federal government issued a cybersecurity alert Thursday after 30 water utilities in Minnesota were targeted in cyberattacks that officials suspect may be linked to Iran.
ABC News reports that the Cybersecurity and Infrastructure Security Agency (CISA) issued a warning to water systems nationwide following a series of cyberattacks that struck Minnesota water plants earlier this week. Multiple U.S. officials told ABC News that the attacks may have Iranian connections, though investigations are ongoing.
According to CISA’s alert, cyber threat actors are specifically targeting programmable logic controllers and changing passwords to prevent operators from accessing their systems. These attacks have resulted in boil water notices being issued and forced facilities to shift to sustained manual operations.
The warning comes two days after Minnesota officials first disclosed that state water systems were compromised during attacks that occurred on Sunday and Monday. Federal and state authorities have opened investigations into whether Iran or hackers associated with the country orchestrated the cyberattacks.
U.S. officials emphasized that they are awaiting more detailed forensic analysis from the hack. They stressed that the current assessment remains preliminary, and no formal announcement or determination has been made regarding attribution. The New York Times first reported Thursday on the investigation into potential Iranian connections.
Minnesota IT Services provided additional information about the attacks on Thursday, explaining that the hackers targeted systems used for remote monitoring and control of equipment, including the programmable logic controllers. The agency clarified the scope of the impact in a statement.
“In this situation, ‘impacted’ means investigators confirmed malicious activity involving a system’s technology. It does not mean every affected community experienced a disruption to water service,” the agency said in a statement.
Minnesota IT Services noted that there are currently no active requests for residents in any Minnesota localities to modify their water usage patterns.
John Israel, Minnesota’s chief information security officer, addressed the ongoing investigation in a statement. “We have provided relevant information to the federal government, which is evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor,” Israel said.
The cyberattacks in Minnesota appear to follow a similar pattern to incidents carried out in other states by suspected Iran-linked actors. The FBI acknowledged awareness of the intrusions but declined to assign responsibility for the attacks in its statement.
In response to the emerging threat, CISA issued specific recommendations for water utilities to enhance their cybersecurity posture. The agency urged facilities to disconnect programmable logic controllers from the internet as a protective measure. For utilities that require remote access capabilities, CISA recommended routing systems through a virtual private network or gateway device rather than maintaining direct internet connections.
The attacks highlight growing concerns about the vulnerability of critical infrastructure to cyber threats. Water systems represent essential services that communities depend on for public health and safety, making them potential targets for hostile actors seeking to cause disruption.
The investigation continues as federal authorities work to definitively attribute the attacks and assess whether similar threats may be targeting water systems in other parts of the country. Officials are analyzing the technical details of the intrusions to better understand the methods used and to develop more effective defensive strategies.
Read more at ABC News here.
Lucas Nolan is a reporter for Breitbart News covering issues of AI, free speech, and online censorship.