Multiple U.S. agencies have confirmed ongoing cyberattacks against water systems that Americans rely on each day. The attacks are now known to have occurred against water facilities in at least seven states.
Here’s what you need to know about the attacks and whether the safety of your drinking water is compromised.
What’s happened?
Since late July, numerous water system facilities across multiple states have been targeted by cyberattacks. The attacks were confirmed by the Federal Bureau of Investigation (FBI) in a public service announcement published on July 30.
According to the alert, the Environmental Protection Agency (EPA) is aware that Water and Wastewater Sector utility companies in multiple states have reported attacks by malicious cyber actors.
How are these attacks carried out?
The attacks are carried out remotely by accessing internet-connected devices at the water systems facilities.
“After remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality,” the FBI said.
“Operational effects reported to the FBI have included loss of pressure and flooding,” the agency added, noting that “Pressure loss in water systems could potentially allow untreated ground water to seep into pipes.”
In a separate notice published by the Cybersecurity and Infrastructure Security Agency (CISA) on July 30, the agency said that “threat actors are targeting water entities of all sizes.”
Where have the attacks happened?
The FBI’s July 30 notice confirms that the agency has received reports of cyberattacks on water systems from facility operators in seven states, without naming the states.
However, multiple media reports have confirmed that a swath of attacks have hit both Minnesota and Michigan. ABC News says that on July 26 and 27, Minnesota IT Services (MNIT) said that more than 30 water systems were targeted in the state.
Additional states where cyberattacks have been reported against water systems facilities include Georgia and Michigan.
In Minnesota, affected communities have included Braham, Plymouth, South St. Paul and Maple Plain, according to WaterWorld Magazine.
Who is behind the attacks?
Federal officials and agencies have not publicly identified who is carrying out attacks on America’s water facilities.
However, multiple reports suggest that officials believe the most likely culprit is Iran or Iranian-linked groups, presumably in retaliation for President Trump’s ongoing war against the nation.
Yet that is apparently not the way the president himself sees things. As reported by Reuters, the president on Friday suggested someone else was to blame.
“We heard in Minnesota there was a cyberattack, and they blame it on Iran. I don’t think so,” said Trump during a meeting with his cabinet. “I think I blame it on Minnesota because they’re grossly incompetent.”
The president has been a longtime critic of Minnesota’s Democratic governor, Tim Waltz, with whom he frequently spars.
As for Waltz, the governor replied to Trump’s comments in a social media post.
“Trump knows exactly who is responsible for this attack, and knows that other states were hit too,” Waltz said. “This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran.”
In a follow-up post, Waltz also suggested that the country was more exposed ot cyberattack now after Elon Musk’s DOGE made cuts to the Cybersecurity and Infrastructure Security Agency.
“DOGE took an axe to CISA and left the U.S. exposed to cyber attacks,” Waltz said. “Thankfully, our experts in Minnesota were able to identify the vulnerability quickly and work with local communities to stop it.”
Has water safety been compromised?
Of course, while politicians trade barbs over who is responsible, what the public is probably most concerned about is the safety of their drinking water. Precisely, is the water safe to use in states where the cyberattacks have occurred?
Thankfully, for now, the answer seems to be that water safety has been maintained.
While the Cybersecurity and Infrastructure Security Agency’s July 30 notice said that the cyberattacks “resulted in boil water notices and sustained manual operations,” no government agency has yet warned that water quality or safety was impacted.
When it comes to Minnesota, the state currently believed to have been hit the hardest by the cyberattacks, WaterWorld reported that officials in the communities affected stated that no water contamination occurred and the drinking water remained safe.