Cyberattacks aimed at disrupting drinking water systems across the United States have spread to at least seven states, federal officials warned Thursday, as mounting evidence pointed toward Iran carrying out the intrusions five months into its war with the United States. Minnesota was the first state to publicly disclose the attacks, and Michigan confirmed this week that several of its municipal water systems had also been targeted, deepening concerns about the vulnerability of the country’s water infrastructure during wartime.
No evidence has emerged that any water supply was altered or made unsafe to drink. Even so, state and local officials nationwide have been placed on high alert for tampering with the industrial computer systems that monitor and adjust chemical-treatment levels and water pressure at municipal utilities. Officials have not publicly named all seven affected states, though Minnesota reported hackers had probed roughly three dozen municipalities and Michigan said nine of its water systems had reported suspicious activity consistent with the pattern federal agencies described.
Investigators have not yet reached a definitive conclusion on responsibility, and officials caution the inquiry remains in its early stages. But they note that Iran has escalated its cyber operations against American targets since the United States and Israel launched military strikes against the country in late February 2026, and that Iranian-linked groups have a documented history of targeting American water infrastructure. Investigators also see little indication of a financial motive, which makes a criminal ransomware operation less likely and strengthens the case for a state-linked actor.
President Trump moved to downplay the threat on Friday, instead directing blame at Minnesota, the state that first identified and reported the intrusions and whose disclosure prompted other states to examine their own systems for similar activity. His comments contradicted an assessment from his own intelligence agencies, which officials say considers Iranian involvement highly likely.
“I think Minnesota is behind it,” Trump told reporters Friday when asked about the possibility of Iranian involvement. “I don’t think there was an Iranian cyberattack.”
Minnesota Gov. Tim Walz, a Democrat, rejected the president’s characterization in a social media post, writing that the intrusion “is what modern warfare looks like.” Federal officials said privately, after Trump’s remarks, that Iran remains the leading suspect, though they stressed the forensic evidence needed to reach a firm public conclusion has not yet been fully assembled — a process that in complex cyber investigations can take months, and sometimes never concludes with full certainty.
Nate George, the mayor of Braham, a small city north of Minneapolis affected by the hack, said in an interview Friday that federal and state officials have communicated informally that Iran is the leading suspect even without a public announcement. “We’re getting bits and pieces of information from the state of Minnesota and the F.B.I.,” he said. “They are pretty sure it’s Iranian actors” but are reluctant to confirm that publicly, he added. A memo obtained by Wired and circulated among water utilities through an industry threat-sharing group reportedly linked the activity to hacking patterns associated with Iran-affiliated actors.
George, a Republican running for Minnesota state auditor, said he was aware of the president’s comments casting doubt on Iran’s role. He said Trump was “entitled to his opinion,” but added that state and local officials still bear responsibility for helping cities strengthen their cyber defenses regardless of who is ultimately found responsible.
The FBI and the Environmental Protection Agency confirmed the broader scope of the campaign in a joint advisory published late Thursday, stating that at least seven states had reported incidents since Monday, and that in some cases the activity had degraded water system operations. In Michigan, a state government spokesman, Dale George, said the affected utilities continued to operate safely and that there were “no known impacts that posed a public health concern,” even as nine municipal systems reported suspicious activity.
The Cybersecurity and Infrastructure Security Agency, in its own advisory issued Thursday, said hackers were “targeting water entities of all sizes” and urged utilities to disconnect vulnerable industrial controllers from the internet. The agency said the intrusions had already “resulted in boil water notices and sustained manual operations” at some affected facilities, and it noted it had been warning for months that Iran might target water utilities and other critical infrastructure as the war continued.
Alex Orleans, a former U.S. government cybersecurity contractor who now serves as chief of threat intelligence at the email-security firm Sublime Security, said Iran has conducted a wide range of hacking operations against American, Israeli and Middle Eastern targets since the war began in February. He said the scale of the water system intrusions marks a significant escalation because of their direct effect on physical infrastructure. “What’s unprecedented here is that we’re seeing direct, tangible effects to live industrial control systems inside U.S. critical infrastructure,” Orleans said.
Former intelligence officials and independent cybersecurity researchers say the hackers do not appear to be targeting specific cities deliberately, but instead are exploiting known vulnerabilities in internet-connected control systems wherever they can be found, meaning any utility running unpatched or exposed equipment could be at risk. Orleans said Iran is likely trying to compromise as many networks as possible before utilities can act on the repeated warnings U.S. agencies have issued about this exact kind of exposure.
This is not the first time Iranian-linked hackers have targeted American water infrastructure. In late 2023, a group known as CyberAv3ngers — later identified by U.S. and Israeli agencies as a front for Iran’s Islamic Revolutionary Guard Corps — breached programmable logic controllers made by the Israeli company Unitronics at a water authority in Aliquippa, Pennsylvania, and other utilities, defacing screens with anti-Israel messages. The U.S. Treasury Department later sanctioned six Iranian military hackers linked to that campaign. Since the U.S. and Israel struck Iranian targets in February 2026, pro-Iranian hacking groups have claimed a broader wave of attacks, including a cyberattack against the medical device maker Stryker, as well as attempted intrusions into surveillance cameras, data centers and industrial facilities across the Middle East, according to earlier reporting on the conflict.
In Braham, Mayor Nate George said city officials had received guidance from the state on patching affected systems and hardening defenses against further Iranian-linked intrusions. Manual workarounds have kept water flowing in the meantime, he said, but the episode exposed how outdated the technology underpinning many small-town water systems remains. “I think the troubling thing on the horizon is how do we move forward to a more secure system,” George said, adding that the cost of upgrading information-technology infrastructure is a major obstacle for municipalities the size of Braham.
The episode marks one of the most direct tests yet of American critical infrastructure since the war with Iran began, and officials say it is likely to intensify pressure on Congress and federal agencies to fund cybersecurity upgrades for the thousands of small water utilities across the country that still rely on aging, internet-connected control systems. Investigations by the FBI, CISA and state agencies were continuing as of Saturday, and officials have not ruled out that additional states beyond the seven already reported could come forward with similar findings in the days ahead.