Iranian-Linked Hackers Target Water Systems Across Seven US States

The scale of the breach is significant. In Minnesota alone, more than 30 community water systems were targeted. While state leaders maintain that no water supplies were compromised, the attacks forced some systems offline, requiring manual resets to restore service.

Programmable Logic Controllers: The Iranian Target

The attacks focused on a specific piece of operational technology: the programmable logic controller (PLC). These devices act as the brain of water infrastructure, signaling valves and pumps to open or close. According to the Cybersecurity and Infrastructure Security Agency (CISA), there has been a significant increase in threat actors targeting these controllers in the Water and Wastewater Systems sector.

View this post on Instagram about iranian linked hackers target, Metro Atlanta water system cyberattack

The risk isn’t just a system outage. Jake Braun, a former deputy national cyber director and current lead of the Cyber Policy Initiative at University of Chicago, warns that manipulating these controllers could potentially cause unsafe drinking water to flow into homes.

“This was a signal from the Iranians to the administration of the American people that they have the ability to do this.”

Jake Braun, former deputy national cyber director

Braun notes that these utilities often support military installations, suggesting the attacks are a demonstration of capability. He describes the event as a national attack intended to warn the U.S. administration that Tehran can disrupt essential services if tensions escalate.

Trump Weighs Expanding Military Strikes Against Key Iranian Infrastructure Targets

Disruptions in Georgia and the Midwest

The impact varied by region. In Georgia, Clayton County officials reported a temporary water service disruption last week. While Georgia and federal officials initially declined to confirm if the state was an official target, the timing aligns with the FBI’s report of hits across seven states.

In the metro Atlanta area, a separate but closely timed event occurred on July 17, 2026. A boil water advisory impacted 47,800 customers in South Fulton and Fairburn. Although Atlanta Department of Watershed Management officials attributed that specific advisory to a power outage at the Adamsville Pump Station, the broader pattern of instability in the region has drawn scrutiny.

US Forces Strike Iranian Military Targets to Protect Commercial Shipping

Minnesota’s experience was more widespread.

Attribution and the Iranian Connection

The FBI’s Cyber Division has acknowledged that malicious cyber actors were responsible for the disruptions. While the U.S. government has not yet made a formal announcement of attribution, multiple officials confirmed to ABC News that investigators are focusing on Iran or associated hackers.

Trita Parsi, Executive Vice President of the Quincy Institute for Responsible Statecraft, suggests these attacks serve as a warning that Iran is prepared to retaliate for U.S. strikes. Parsi describes Iran as a highly capable cyber power that is on par with Israel in some aspects and just one tier below the U.S., China, and Russia.

The political reaction has been stark. Gov. Tim Walz, the 2024 Democratic vice presidential nominee, framed the attacks as a symptom of modern warfare and argued they demonstrate a lack of a winning plan for dealing with Iran.

Vulnerabilities Beyond the Water Sector

The vulnerability of the U.S. power grid and upcoming elections is a primary concern for security experts. Braun indicates that while the power grid is slightly different from water systems, it remains quite vulnerable to similar Iranian hacking efforts.

US Military Intercepts Iranian Missiles and Strikes Militias in Iraq

This pattern of targeting critical infrastructure is not new. CISA and the FBI previously issued an advisory in April regarding Iranian-affiliated targeting of PLCs. According to Reuters, this activity predates the current war between the U.S. and Iran, with other targets including the Los Angeles County Metropolitan Transportation Authority and the medical services company Stryker in March.

The current situation leaves a critical question of forensics. While Minnesota IT Services (MNIT) is supporting the investigation, they are deferring attribution to federal partners who can assess the incident alongside international threat intelligence. Until that detailed forensics is complete, the full extent of the Iranian involvement remains a preliminary determination.