Federal and state investigators are examining cyberattacks involving water-system technology in multiple states. Michigan confirmed activity affecting nine systems after Minnesota disclosed related incidents; officials emphasized that a confirmed intrusion did not necessarily mean drinking-water service was disrupted. Michigan joined Minnesota in confirming malicious activity at water utilities, while officials said affected systems remained safe and the actor behind the campaign had not been established.
Michigan officials said malicious cyber activity affected technology at nine water systems, while also saying the systems were operating safely and that impact did not mean every community experienced a service disruption. Minnesota had previously disclosed attacks involving technology used by water systems to monitor and control equipment remotely, bringing federal investigators into a campaign that reporting placed across several states.
The FBI and the Cybersecurity and Infrastructure Security Agency were investigating, and a recent federal advisory warned that Iranian hackers have targeted water and wastewater systems and other operational technology. The warning about Iranian activity establishes a threat pattern, but public reporting had not established who conducted these particular intrusions; attribution therefore remained an open investigative question.
Officials distinguished access to or malicious activity within utility technology from contamination or loss of water service, and no broad public-health failure was reported in the affected systems. U.S. water utilities use a mix of information technology and industrial controls, creating possible pathways to pumps, valves, pressure controls, storage, and treatment operations when remote systems are poorly secured.
Earlier Iranian-linked operations targeted programmable logic controllers used by water utilities, including a 2023 campaign involving Israeli-made equipment, giving agencies a documented basis for their current warning.
The American water sector includes tens of thousands of systems, many serving small communities with limited cybersecurity budgets and substantial existing maintenance obligations. Federal agencies have repeatedly urged utilities to remove default passwords, limit remote access, inventory operational technology, and maintain manual fallbacks for essential functions.
A confirmed intrusion can range from reconnaissance or compromised monitoring equipment to a disruptive operational event, so incident-by-incident impact assessments remain necessary. Investigators had not publicly identified the actor responsible for the current campaign, and the full number of affected systems and states was still being reconciled.
Additional state disclosures and any federal attribution supported by technical evidence. Whether utilities report service disruption, unsafe water, or confirmed manipulation of operational controls.
Minnesota had previously disclosed attacks involving technology used by water systems to monitor and control equipment remotely, bringing federal investigators into a campaign that reporting placed across several states. The American water sector includes tens of thousands of systems, many serving small communities with limited cybersecurity budgets and substantial existing maintenance obligations. Officials distinguished access to or malicious activity within utility technology from contamination or loss of water service, and no broad public-health failure was reported in the affected systems.
The FBI and the Cybersecurity and Infrastructure Security Agency were investigating, and a recent federal advisory warned that Iranian hackers have targeted water and wastewater systems and other operational technology. A confirmed intrusion can range from reconnaissance or compromised monitoring equipment to a disruptive operational event, so incident-by-incident impact assessments remain necessary. Investigators had not publicly identified the actor responsible for the current campaign, and the full number of affected systems and states was still being reconciled.