(CNN) — Hackers have targeted water systems in several US states in a coordinated cyberattack that has caused some utilities to issue boil-water notices and switch to manual mode, taking their systems offline, according to US officials.
It’s one of the most serious cyberattacks on water systems in the US in years, according to some analysts. The US Cybersecurity and Infrastructure Security Agency (CISA), the FBI and the Environmental Protection Agency have for the last week been scrambling to try to help secure the water facilities and ensure that the safety of drinking water isn’t affected. No incidents of contamination have been reported.
The hackers “are targeting water entities of all sizes,” CISA said in a warning Thursday that urged water facilities to get vulnerable industrial equipment offline.
US and state officials are treating Iran as one of the suspects behind the hack, but have not made a formal determination of who is responsible and are wary of false flags.
The first public sign of the cyberattacks came from Minnesota authorities, who said that hackers on Sunday night and Monday morning targeted about 30 water systems in that state. The “likely desired impact” of the hackers’ intrusion at the water facilities was “to cause loss of system pressure and subsequent potential contamination of water supply,” said the memo distributed this week by the Minnesota Bureau of Criminal Apprehension and obtained by CNN.
At a cabinet meeting Friday, President Donald Trump blamed Minnesota authorities for the hack and cast doubt on whether Iran was involved. “They like to say, “Oh, it’s Iran.’” Trump said. “Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota.”
The New York Times first reported on the possible Iran connection.
The hackers are targeting internet-facing programmable logic controllers (PLCs), the devices that allow machinery to communicate at water facilities and other industrial plants. PLCs monitor water pressure, chemical dosing and other features in water systems to ensure they are safe.
The hacks are not complicated: The attackers are breaking into PLCs that are sitting online and vulnerable.
“I suspect that those attackers are going to … continue to look nationally across the infrastructure,” John Israel, Minnesota’s chief information security officer, told CNN on Tuesday. The hackers will “continue to rattle those doorknobs and try to break into systems that have weak configurations,” Israel added.
He was right.
Roughly six states have reported related cyber incidents over the last week, according to multiple sources familiar with the investigation.
Officials in Wisconsin detected malicious cyber activity at their water facilities on Monday and urged utilities to take “immediate action to prevent potentially serious impacts to our systems,” according to a memo from the state’s Department of Natural Resources obtained by CNN.
The incident is another in a series of recent cyberattacks that have raised safety concerns for US water utilities. The water sector has for years struggled with funding and training to defend itself from cyber threats.
The Water Information Sharing and Analysis Center (WaterISAC), an industry hub for cyber threat data, has urged utilities to shore up their systems in the last week.
“The scale and coordination of the recent cyberattacks targeting Minnesota water suppliers is unprecedented,” Gus Serino, a longtime cybersecurity specialist focused on the water sector told CNN.
“While the inherent resilience of the water sector helped limit operational impacts, these incidents once again demonstrate that many drinking water utilities continue to rely on technology architectures that lack fundamental cybersecurity controls capable of preventing or significantly impeding this type of attack,” Serino said.
While the US government has not blamed anyone for the spate of hacks, Iran does have a history of hacking the water sector, including during the current war with the US.
In April, CNN reported that Iran-linked hackers had successfully targeted and caused disruptions at multiple US oil and gas and water sites.
“The rising number of water compromises is deeply concerning. So much depends upon water… No water, no hospital, no kidding… in 2-4 hours,” Joshua Corman, another industrial cybersecurity expert who co-founded I am the Cavalry, a volunteer group that focuses on cybersecurity for resource-poor organizations.
“Water systems have enjoyed the benefits of remote access, but now those who wish us harm have it, too,” Corman told CNN. “With great connectivity comes great responsibility. We should be asking ourselves: if we can’t protect it, should we disconnect it?”
This story has been updated with additional developments.
The-CNN-Wire
™ & © 2026 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.