Iran US Waterworks Hack

Introduction 

In late July 2026, several coordinated cyber-attacks crippled waterworks in several US states including Minnesota, New Jersey, Georgia and South Dakota. Investigations revealed that the likely suspects with several hacker groups affiliated with Iran or at least supportive of the country (BBC.com, 2026). The come at a very politically sensitive time due to the ongoing Iran-US war over Iran’s nuclear capabilities, giving US groups like the FBI potential suspects, although not enough to outright say it was Iran. But what were the effects of the hack? And what does this imply for the wider picture of US-Iran relations? 

Entry Vector and Motivation 

The attacks were first detected on July 26th and 27th when Minnesota IT Services (MNIT) detected cyber-attacks on 30 of their community water systems, prompting them to activate their cyber incident response capabilities (mn.gov, 2026). The water systems suffered from disrupted communications and automatic functions, forcing staff to switch to manual operations until the water systems were restored roughly an hour and a half later, allowing residents to resume normal water usage. A message was later found from an Iran backed hacker group called CyberAv3ngers claiming responsibility (Schappert, 2026A). 

However, the attacks weren’t just limited to Minnesota, as 12 other US states reported similar attacks on their water systems over the next few days, including South Dakota, New Jersey, Georgia and Michigan. these states reported similar issues with remote functionality and communication, though thankfully they were able to quickly resolve these issues without any reported risks to public health. Independent analyses determined the attacks were consistent with state back behaviour rather than usual hacker motives of extortion (Schappert, 2026B). 

The Federal Bureau of Investigation (FBI) investigated the attacks and determined how the hackers illegitimately accessed state water systems (FBI National Press Office, 2026); Waterworks Facilities require Operational Technology such as Programmable Logic Controllers (PLCs) to automatically manage their systems, such as controlling pumps and valves. The hackers started out by searching for access, including internet connected PLCs, companies that provided these services, stolen passwords or system vulnerabilities they can exploit in the industrial equipment they may lack modern cybersecurity measures (Akoto, 2026). Once they found their access point, they then directly and remotely accessed PLCs, allowing them to change their IP addresses and passwords so only they had full control for them, allowing the hackers to sabotage the access and functionality of select water systems and their equipment (FBI National Press Office, 2026). 

The FBI have yet to identify a specific culprit outside of the CyberAv3ngers, a group that had previously attacked US water systems the US offers a $10m reward for accurate information that can identify its members (Schappert, 2026B).  

Around the same time, a separate cyber-attack was conducted by a relatively new ransomware gang called Barracuda, who hacked Micro-Comm, a Kansas Water Systems Firm not on Iran’s orders, but purely for profit by holding sensitive files for ransom. It’s likely they used the chaos caused the main attacks to pull the attack off, leading to investigations by the FBI (Vicens, 2026). 

Duration 

The attacks happened over a few of days between July 26th and 28th before they were quickly resolved (McLaughlin, 2026). 

Recovery 

As previously mentioned, the attacks were quickly and swiftly resolved by local water facilities after their workers were presumably able to regain control of their PLCs. A $10.8 million grant was handed out by the US government to help train the US workforce in water sector careers, notably in cybersecurity and how to handle cyber threats (epa.org, 2026). 

In the wake of the attacks, The US Cybersecurity & Infostructure Security Agency (CISA) encouraged the water sector to ramp up cybersecurity to protect their Programmable Logic Controllers (PLCs) that allow users to operate waterworks infrastructure, such as disconnecting PLCs from the internet, updating password protection, using VPNs for added security and protected communication, as well as only allowing access to known engineering consoles and other critical IPs and other operational technology (cisa.gov, 2026)   

Impact   

Political 

As mentioned, ‘Cyb3rAvengers’ – the hacker group behind the hack – have been linked to Iran as they have backed the group as well as several more hacker group. The response is likely to be expected as part of escalating tensions between the US and Iran since their war started in February 2026. Interestingly, the FBI never directly named Iran as responsible (Robins-Early and Kerr, 2026). 

Donald Trump, the current US President, blamed Minnesota itself for the attacks, calling them ‘grossly incompetent’, leading to an angry response from Tim Waltz, Governor of Minnesota, calling out Trump for not recognising this form of Modern Warfare and for not having a plan for winning the Iran War, something Trump has been criticised on. The Trump administration is unlikely to directly accuse Iran, because of its own information war (BBC.com, 2026). 

These kinds of attacks on US systems can be defined as ‘asymmetrical warfare’, something that isn’t new to Iran (Kollender, 2026). In fact, many similar cyber-attacks on US infostructure have been linked back to an Iranian-linked hacker group called Handala, who recently claimed responsibility for hacking a water facility in California in June 2026. Iranian cyber-attacks date all the way back to 2017, hacking anything form infostructure, to US voter information and presidential campaigns (BBC.com, 2026). 

Local 

As previously mentioned, Minnesota and at least 12 other states were affected by the cyber-attacks on some of their waterwork facilities. The worst hit state was Georgia, who had 9 facilities affected, including a pump station that led to lowered water pressure that could have affected drinking water, causing a boil water warning to be sent out to locals, but the issue was quickly resolved and there were no reports of illness. As for the other states, each only had 1-3 of their facilities affected as the hackers temporarily took control of their Operational Technology (Harding and Pusztaszeri et al, 2026). 

Local communities, especially those employed as water facility engineers, voiced concern over how easy it can be for hackers to access vital systems that run on decades old computer systems that would be expensive and time consuming to replace, with the former CIO for the city of Waco, Texas stating that, “Water isn’t data. Breach a billing system and it costs money … breach a treatment plant and people get sick, or untreated sewage ends up in a river.” (McLaughlin, 2026).  

The American Water Works Association (AWWA) sent a letter urging more support for their facilities as critical infrastructure that has been historically underfunded and therefore more susceptible to modern cyber-attacks. Their demands included more funding and the reauthorisation of programs to help their workforce recognise and prepare for cyber-attacks (awwa.org, 2026). 

The Minnesota city of Braham encouraged their 1700 residents to minimalize water usage whilst they resolved the issues with their waterworks. Whilst staff were able to regain operational control of their facility, the city had to rely on its water tower reserves in the meantime. The city of Plymouth – just outside of Minnesota’s capital city Minneapolis – were able to keep their water systems running during a communications outage during the hack, allowing them to keep supplying water to its 80,000 residents without disruption (Stengle and Tucker, 2026). 

Conclusion 

Although the affected water facilities were able to effectively regain control without any significant downtime, the consequences and damages extend beyond temporarily compromised water supplies. It represents a severe escalation in tensions between the US and Iran, as well as how modern warfare continues to find new ways to disrupt people and businesses alike.   

Whilst major political issues and warfare require complex solutions, local issues with cybersecurity are a lot simpler; the cyber-attacks serve as a warning that water systems, some of the most unassuming facilities are the ones we may rely on the most and therefore require the highest and most updated security. Why else would they have been targeted in the first place. In the end, with hackers becoming bolder and their methods becoming more elusive, businesses and essential facilities will require both a seamless protection and a seamless recovery.      

Sources 

• Akoto, W (2026): Hackers targeted water systems in seven US states. Here’s how they tried to take control. Online News Article published by theindependent.com: https://www.independent.co.uk/news/world/americas/cyberattack-minnesota-hackers-b3028647.html 

• Awwa.org (2026): AWWA urges expanded U.S. cybersecurity support, measures. Online Press Release published by the American Water Works Association (AWWA): https://www.awwa.org/AWWA-Articles/awwa-urges-expanded-u-s-cybersecurity-support-measures/  

• BBC.com (2026): Did Iran hack water systems in at least seven US states? Online News Article published by BBC.com: https://www.bbc.co.uk/news/articles/c934dq95zpgo   

• cisa.gov (2026): CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs. Online News Alert published by The US Cybersecurity & Infostructure Security Agency (CISA.org): https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs  

• Epa.org (2026): Trump Administration Announces $10.8 Million in Available Grant Funding to Strengthen Water Sector Workforce. Online News Article published by United States Environmental Protection Agency (EPA): https://www.epa.gov/newsreleases/trump-administration-announces-108-million-available-grant-funding-strengthen-water 

• FBI National Press Office (2026): Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions. Online Press Release Published by FBI.gov: https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet–facing-programmable-logic-controllers-causing-operational-disruptions   

• Harding, E; Pusztaszeri, A; Williams, L; Shah, N; Vyas, A; and Musheno. C (2026): Mapping Iranian Cyberattacks on U.S. Water Systems. Online Commentary Published by the Centre For Statistics & International Studies (csis.org): https://www.csis.org/analysis/mapping-iranian-cyberattacks-us-water-systems 

• Kollender, T (2026): Iran’s attacks on US water systems are just the beginning . Online News Article published by thehill.com: https://thehill.com/opinion/cybersecurity/6047624-iranian-hackers-water-infrastructure/ 

• McLaughlin, J (2026): Are hacks of U.S. water facilities a new front in the Iran war? Online News Article published by npr.org: https://www.npr.org/2026/08/12/nx-s1-5927437/cyberattack-water-iran-war 

• Mn.gov (2026): MNIT activates statewide cybersecurity response to support affected communities and protect critical infrastructure. Online Blog published by Minnesota IT Services (MNIT) (mn.gov/mnit): https://mn.gov/mnit/media/blog/?id=38-761869 

• Schappert, S (2026A): Iran hackers hit 30 Minnesota public water systems in coordinated cyberattack. Online News article Published by Cybernews.com: https://cybernews.com/security/minnesota-water-systems-cyberattack-iranian-hackers/ 

• Schappert, S (2026B): Iran-linked water cyberattacks spread to 12 US states: new report. Online News article Published by Cybernews.com: https://cybernews.com/security/michigan-georgia-water-system-attacks-iran/  

• Sganga, N (2026): U.S. investigating if Iran was behind cyberattack on water systems in 7 states, including Minnesota and Michigan. Online News Article published by cbsnews.com: https://www.cbsnews.com/news/us-investigating-iran-cyberattack-minnesota-water-systems/ 

• Stengle, J; and Tucker, E (2026): Cyberattacks on Minnesota water systems investigated as officials warn about Iranian hackers. Online News Article published by theindependent.com: https://www.independent.co.uk/news/minnesota-fbi-plymouth-new-york-city-justice-department-b3025014.html 

• Robins-Early, N; and Kerr, D (2026): US water facilities targeted by ‘malicious cyber actors’ – who’s to blame? Online News Article published by theguardian.com: https://www.theguardian.com/technology/2026/aug/04/us-cyber-attacks-water-minnesota-iran 

• Vicens, A (2026): FBI probe into cyberattacks on US water systems expands after tech supplier is targeted. Online News Article published by theindependent.com: https://www.independent.co.uk/news/world/americas/water-system-hacks-fbi-iran-b3039960.html