Iranian Hackers Suspected in Cyberattack on Minnesota Water Systems
U.S. investigators are looking into a cyberattack that affected more than 30 community water systems in Minnesota, with suspicions pointing towards Iranian hackers. The Minnesota IT Services (MNIT) reported that the coordinated attack occurred over the weekend, targeting the operational technology of these water systems. Fortunately, the Minnesota Department of Health has stated that there are no current requests from cities to change their drinking water usage, indicating that the situation has not escalated to a public health crisis.
According to sources familiar with the investigation, the tradecraft employed in the attack and the lack of a ransom demand led analysts to believe that Iranian hackers were responsible. However, officials have cautioned that this assessment may evolve as more information becomes available. The FBI has acknowledged the situation, stating that they are actively engaged in protecting critical infrastructure and are prepared to address various cyber threats.
The attack specifically targeted the infrastructure responsible for managing and monitoring municipal water towers. In one instance, the mayor of Braham, Nate George, reported that a plant operator discovered issues with the water tower's operations, prompting an investigation that revealed the computerized control system had been compromised. Fortunately, the city was able to isolate the affected system, restore a backup, and resume operations within about 90 minutes, while residents continued to receive water from the city’s supply.
MNIT has confirmed that the investigation is ongoing and has not yet attributed the attack to a specific actor. They are collaborating with federal, state, local, Tribal, and private-sector partners to investigate the incident and bolster the security of Minnesota's critical infrastructure. John Israel, MNIT Assistant Commissioner, emphasized the need for a coordinated response to cyberattacks on critical infrastructure, highlighting the agency's commitment to sharing intelligence and supporting affected communities.
The breach was first detected on Sunday, and officials noted that similar threats may be occurring in other states. Nick Andersen, acting director of the Cybersecurity and Infrastructure Security Agency (CISA), mentioned that the agency is aware of multiple incidents affecting local water utilities. In the days leading up to the attack, CISA had issued a warning about ongoing Iranian-affiliated cyber activities targeting operational technology devices across the U.S.
The advisory from the FBI's Cyber Division reiterated that Iranian cyber actors are actively targeting U.S. critical infrastructure, and the agency is dedicated to identifying and disrupting these threats. The situation remains fluid as investigations continue, and officials work to ensure the security of essential services.
