US warns of increased cyberattacks on water systems, Iran suspected

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a significant increase in cyberattacks targeting water and wastewater systems, advising operators to disconnect these systems from the internet as a precautionary measure. This alert follows a coordinated cyberattack that affected over 30 community water systems in Minnesota earlier this week.

US investigators are reportedly examining a potential link between the Minnesota attacks and Iran, though this assessment is preliminary and subject to change as more data is collected. The heightened scrutiny comes amid ongoing tensions and exchanges of attacks between the US and Iran. CISA has previously issued advisories warning about Iranian-affiliated hackers targeting internet-connected operational devices, including programmable logic controllers (PLCs), used in critical infrastructure.

According to the state's IT agency, the Minnesota attacks involved malicious activity and remote monitoring and control of equipment. While investigators confirmed "malicious activity involving a system's technology," not all communities experienced service disruptions. However, some attacks have resulted in "boil water notices" and necessitated "sustained manual operations" due to operators being locked out by changed passwords. The FBI has received reports of operational effects such as loss of pressure and flooding from utility companies in at least seven states.

Minnesota's chief information security officer, John Israel, stated that the state has shared relevant information with the federal government for broader evaluation in a national context. Previous federal advisories have highlighted similar targeting of industrial control systems by Iranian-linked groups.