U.S. Probing Iran Link to Cyberattack on 30+ Minnesota Water Systems

The attacks began earlier in the week of July 27, 2026, reported as happening since Monday, and were publicly described by state officials and federal authorities by Thursday, July 30⁠2⁠10. Hackers went after operating technology, the hardware and software that lets a small utility manage pumps, pressure, valves and treatment from afar rather than by having someone turn every dial on site⁠2⁠10. In some cases the intrusions led to pressure loss and flooding, and in others to boil-water notices and a shift to manual operations⁠2⁠3⁠4. Officials stressed that drinking water remained safe, a crucial line repeated as the scope widened⁠2.

Minnesota was the center, but it did not stay a Minnesota story. The FBI later said water and wastewater utilities in at least seven states, including Minnesota and Michigan, reported incidents that week⁠2⁠3⁠10. CBS News reported federal investigators were working to determine whether Iran orchestrated the attack, while ABC News reported that U.S. officials said Minnesota systems may have been targeted by Iranian groups⁠2⁠6. CNN described a sweeping cyberattack on water systems in multiple states that left U.S. officials on edge, with boil-water notices and manual operations underscoring how quickly a remote intrusion becomes a local emergency⁠4.

On the ground, the details were concrete and uneven, as they always are when small systems are hit. State officials said the attack hit operating technology at over 30 systems, including Plymouth, Minnesota's, earlier that week⁠10. Fortune reported hackers shut down one Minnesota town's water plant, saved only by its water tower, a reminder of how much of American water safety still depends on gravity and stored volume when the computers fail⁠11. The broader pattern — pressure loss, flooding, boil-water notices, conservation orders — showed attackers able to disrupt operations even without poisoning anyone⁠2⁠3⁠4.

From the start, the question was not just what broke but who broke it. The Washington Post reported that U.S. intelligence agencies have assessed that Tehran was likely behind a coordinated attack on more than 30 municipal water systems in the state⁠5. WIRED published a memo from the water-sector information sharing group WaterISAC linking dozens of attacks on Minnesota utilities to Tehran⁠8. WIRED noted the attacks came in the context of a U.S. war against Iran launched in late February, after Iranian hackers retaliated with intrusions including one against medical supplies company Stryker⁠8.

That history matters because this playbook looked familiar. CBS News noted a group tied to Iran's Islamic Revolutionary Guard Corps used a similar playbook to breach water facilities in 2023⁠2. The parallel gave investigators a starting theory: an actor that had practiced infiltrating critical infrastructure was now refining its focus on the software that lets cities manage water from afar. But familiarity is not proof, and the sources in this case do not agree on how far to go.

Nextgov/FCW, reviewing the industry memo it obtained, reported that CISA urged utilities to take exposed systems offline, and that the memo mentions Iran but does not directly present evidence attributing the latest Minnesota incident to the country⁠9. CBS separately reported investigators were not ruling out the possibility that someone wanted to appear Iranian-based, exploiting the overseas conflict⁠2. In other words, the public record holds two things at once: a likely Tehran assessment reported by the Post, and an explicit lack of direct attribution evidence in the operational memo utilities actually received⁠5⁠9.

The federal response reflected that split between urgency and uncertainty. The FBI and EPA issued a nationwide warning to utilities on Thursday, July 30, 2026, that hackers were trying to disrupt critical water infrastructure⁠3. CISA pushed the same practical message — get exposed systems off the internet — without settling the who⁠9⁠7. For operators, attribution can wait; isolation cannot. For the public, the gap is harder to live with, because fear spreads faster than any pressure drop when no one will name the intruder with confidence.

What is missing from the file is as telling as what is in it. None of the provided source texts include verbatim official quotes that can be reproduced, and the full list of the seven affected states beyond Minnesota and Michigan is not confirmed in the material available. The final investigative outcome and attribution conclusion are also not resolved in these sources. That is normal in the first days of a critical-infrastructure incident, when warnings go out before forensics come back, but it means every confident claim about motive should be read as provisional.

The safest way to read this week is as a warning that worked, barely. A coordinated attack found the same remote door in dozens of places, caused real but limited physical effects, and forced manual fallbacks that older designs — towers, valves, human operators — were still able to provide⁠2⁠3⁠11. The next question is whether front-line utilities get the help to stay offline where it counts, and whether investigators can close the attribution gap without overstating what the early memos actually proved⁠9⁠5⁠2.