EMET NEWS PRESS

Assessment I

Minnesota IT Services stated on 28 July that operational technology at more than 30 community water systems had been targeted. The agency activated its statewide cyber-response capabilities and coordinated with the FBI, the Environmental Protection Agency and state and local authorities. The Minnesota Department of Health worked directly with affected utilities. At that time, state authorities were unaware of any active request for residents to modify their drinking-water use.

John Israel, Assistant Commissioner at Minnesota IT Services and the state’s Chief Information Security Officer, described the investigation as ongoing. Federal agencies were examining the incidents in a broader national context and assessing whether they could be attributed to a specific threat actor.

The FBI and the Environmental Protection Agency reported on 30 July that water and wastewater utilities in at least seven states had experienced incidents. The observed activity targeted internet-exposed programmable logic controllers manufactured by Rockwell Automation and Allen-Bradley, particularly the MicroLogix 1100 and 1400 series.

The attackers changed IP addresses and enabled new passwords. Operators consequently lost visibility into connected equipment or access to control functions. According to the FBI, at least one organization identified modified PLC project files and discrepancies in control logic. Affected entities reported pressure loss and flooding as operational effects. The available government information does not establish how many facilities experienced these specific consequences.

Assessment II

The incidents reached industrial control systems and affected physical processes at individual facilities. The campaign therefore extended beyond unauthorized access to municipal administrative networks. According to the published information, the damage remained locally confined. Authorities reported neither a widespread interruption of water services nor confirmed deterioration of drinking-water quality.

Government notices identify directly accessible PLC systems as the principal observed entry point. The publicly available reporting contains no evidence of an exploited zero-day vulnerability or malware developed specifically for this campaign. It does not exclude the use of additional technical methods. The available evidence supports an assessment of the observed access route, but not a complete reconstruction of every incident.

Attributing the attacks to Iran is analytically plausible but remains unconfirmed. Reuters reported, citing US investigators, that a possible Iranian connection was being examined as likely. A joint advisory issued in April by the FBI, CISA, NSA, EPA, Department of Energy and Cyber National Mission Force had already documented an Iran-affiliated APT campaign targeting American PLC systems. Publicly available forensic evidence does not establish that the same actors conducted every attack reported in July.

Attack Vector and Operational Effects

The targeted PLC systems monitor or control technical processes. Their functions differ among facilities and may involve measurements, pumps or pressure conditions. The FBI determined that the severity of an incident depended on the role of the compromised controller and the operator’s ability to shift to manual procedures.

Reuters reported that individual systems had to be temporarily taken offline and manually reset. Manual operations therefore provided an important fallback capability. Publicly available information does not establish the extent to which these procedures prevented additional damage.

The FBI identified similarities among network configurations at several affected facilities, some of which had been installed by third-party providers. According to the agency, recurring configurations could allow attackers to replicate a successful intrusion across other customers operating within the same technical environment. A causal connection between these structures and every reported incident has not been established.

Iranian Operational Patterns

The joint cybersecurity advisory published in April documented an Iran-affiliated APT campaign against internet-exposed Rockwell Automation controllers. The observed actors accessed PLC project files and manipulated information displayed on Human Machine Interfaces and SCADA systems. US authorities assessed that the campaign sought to cause disruptive effects inside the United States.

The advisory also referred to operations conducted by CyberAv3ngers, also known as the Shahid Kaveh Group. US authorities assess that the group is affiliated with the Cyber Electronic Command of Iran’s Islamic Revolutionary Guard Corps. Beginning in November 2023, the group compromised at least 75 devices across several US critical-infrastructure sectors. That campaign primarily targeted internet-exposed Unitronics controllers.

The July attacks show similarities in target selection and access method. They involved different specific controller models from those targeted during the 2023 campaign. Technical parallels support an investigation of Iran-affiliated actors, but do not independently establish attribution.

Structural Vulnerability of the Water Sector

In May 2026, the Government Accountability Office identified more than 153,000 drinking-water systems and approximately 16,500 wastewater systems in the United States. Many smaller operators have limited financial resources and few specialist cybersecurity personnel. Older control systems can be difficult to integrate with modern security mechanisms and may require substantial investment to replace.

Connecting operational technology to internet-enabled devices supports the remote monitoring of geographically dispersed facilities. It also expands the attack surface when controllers are directly accessible or remote connections are not mediated by secure gateways. Limited resources and the priority given to statutory water-quality requirements can further delay cybersecurity investment.

The GAO confirmed regulatory gaps affecting the sector. According to the agency, mandatory cybersecurity risk-assessment requirements remain absent for wastewater systems and certain drinking-water utilities. The Environmental Protection Agency identified significant limitations in its authority under applicable federal drinking-water and clean-water legislation. Parts of the sector therefore continue to depend on voluntary safeguards and state-level requirements.

Review of the Media Assessment

The ZEIT article accurately identifies the structural vulnerability of American water systems and the suspicion surrounding Iran-affiliated actors. Its description of the Iran war reaching the American heartland constitutes a journalistic interpretation. The confirmed government record establishes that cyberattacks occurred during the conflict, but does not demonstrate that the Iranian state directed the July operations.

The description of the observed attack method as technically unsophisticated is consistent with the published government information when limited to the known access vectors. Its operational significance derives from its connection to physical processes. A technically straightforward method and limited individual effects remain compatible with a strategic interest in repeatable disruption.

Strategic Significance

Water and wastewater systems provide state-affiliated actors with a means of exerting asymmetric pressure. Even geographically limited interference can occupy municipal authorities and generate public concern. It can also expose response times and manual fallback procedures without requiring a large-scale service interruption.

Successful access may therefore hold intelligence value alongside its immediate disruptive effect. Intrusions can provide information about deployed controllers, network architectures and recovery procedures. The published evidence does not establish whether the July operations primarily sought disruption, technical testing or preparation for subsequent access.

Intelligence Assessment

The incidents confirm an active threat to American water infrastructure through access to internet-exposed control components. The publicly documented attack vector exploits insufficiently protected remote connectivity and recurring technical configurations. Available government information does not establish whether every incident formed part of a centrally directed campaign.

Iran-affiliated actors have documented experience targeting PLC systems and have caused operational disruption across US infrastructure sectors since at least March 2026. The current conflict and technical parallels increase the plausibility of Iranian involvement. Reliable attribution of the July attacks requires additional correlation involving attack infrastructure, operational methods and forensic indicators.

Verifiable indicators of escalation would include similar activity outside the water sector, manipulation of safety-critical control logic or prolonged service interruptions. A formal government attribution or a claim of responsibility containing non-public technical details would carry additional significance.

Glossary

APT
Advanced Persistent Threat; a persistent and often state-supported cyber actor with specialized capabilities.

HMI
Human Machine Interface; an operating and display interface connecting facility personnel with industrial control systems.

OT
Operational Technology; hardware and software used to monitor or control physical processes.

PLC
Programmable Logic Controller; an industrial controller used to automate technical systems.

SCADA
Supervisory Control and Data Acquisition; a system used to centrally monitor and control geographically dispersed facilities.

Zero-day vulnerability
A security flaw for which no effective protection or manufacturer patch is available when exploitation begins.

Persons Register

John Israel
Assistant Commissioner at Minnesota IT Services and Minnesota Chief Information Security Officer; described the state response and ongoing investigation.

References

Minnesota IT Services
MNIT activates statewide cybersecurity response to support affected communities and protect critical infrastructure
28 July 2026
mn.gov/mnit/media/blog/?id=38-761869

Federal Bureau of Investigation
Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions
30 July 2026
fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions

FBI, CISA, NSA, EPA, DOE and USCYBERCOM
Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
7 April 2026
ic3.gov/CSA/2026/260407.pdf

US Government Accountability Office
Critical Infrastructure Protection: Actions Needed to Address Persistent Cybersecurity Threats to the Water and Wastewater Sector
21 May 2026
gao.gov/products/gao-26-109159

Reuters
US cyber defense agency warns hackers are increasingly targeting water systems
31 July 2026
reuters.com/world/us-cyber-defense-agency-warns-increased-hacker-targeting-water-utilities-2026-07-30

DIE ZEIT
Hacker in der Wasserleitung
3 August 2026
zeit.de/digital/2026-08/cyberangriffe-us-wasserversorgung-hacker-iran-infrastruktur