7 States’ Water Systems Hit by Iran-Linked Cyberattacks

Cyberattacks on U.S. water utilities have spread to at least seven states, the FBI warned in an alert issued August 1, 2026. The bureau did not disclose which additional states were targeted or the extent of the disruptions.

The attacks began in Minnesota, where more than 30 utilities were breached in late July. They disabled programmable logic controllers—the devices that link software to physical equipment—and prompted boil-water notices in some areas, suggesting possible water contamination, the Cybersecurity and Infrastructure Security Agency (CISA) said.

Iranian-affiliated hackers remain the prime suspects. A CISA advisory in April 2026 first pointed to that link, and a leaked memo obtained by WIRED later confirmed the group’s role in the Minnesota incidents.

On July 31, 2026, President Donald Trump blamed Minnesota Governor Tim Walz’s administration for the attacks, a response reminiscent of his 2016 dismissal of Russian election interference.

The FBI and CISA urged utilities to immediately secure programmable logic controllers by removing them from the internet, enforcing strong passwords, and setting up allow-lists. The FBI warned the campaign may expand further, while CISA continues to monitor the situation. The bureau and the Environmental Protection Agency are working with affected utilities on the response.