US water facilities targeted by ‘malicious cyber actors’ – who’s to blame?

Federal authorities have issued a stern warning that "malicious cyber actors" are targeting water and wastewater facilities across at least seven US states, with Minnesota experiencing the most significant disruption. The attacks have caused issues ranging from low water pressure in homes to some utilities issuing boil-water notices, though no cases of drinking water contamination have been reported.

The US Cybersecurity and Infrastructure Security Agency (CISA) stated that the threat actors target water entities of all sizes, as critical infrastructure systems can be particularly vulnerable in the digital age. Much of the problem stems from water facilities' connections to the internet, which hackers can exploit to infiltrate, change passwords, and lock out operators.

While the FBI has initiated an investigation, it has not directly blamed Iran for the coordinated attacks, which are believed to have increased since the war began nearly six months ago. Donald Trump has claimed the attacks are Minnesota's fault, citing the state's alleged incompetence. However, Minnesota Governor Tim Walz has refuted Trump's claims, emphasizing that other states were also affected and calling for accountability.

Law enforcement and cybersecurity agencies have not publicly identified the hacking groups behind the attacks or explicitly accused Iran of orchestrating them, though unnamed government officials have suggested Iranian involvement. CISA previously warned in April about Iranian-backed cyber-attacks targeting critical infrastructure, particularly programmable logic controllers in water systems, and updated its advisory in July with additional guidance on system security and vulnerability of specific manufacturers.

Foreign-backed cyber-attacks have targeted water infrastructure in recent years, including Russian-linked attacks in rural Texas and Iranian-linked attacks on Pennsylvania's water systems. Cybersecurity experts and industry groups have called on the US government to address vulnerable infrastructure and invest in defenses, urging the extension and funding of the state and local cybersecurity grant program, which is set to expire in September.