Did Iran hack water supply systems in seven US states?
US authorities are investigating whether Iran-directed hackers carried out coordinated cyberattacks on water utilities in at least seven states, with Minnesota reporting over 30 systems targeted.
Intelligence analysis by Llama
US cybersecurity officials are probing a possible Iranian link to coordinated cyberattacks on water utilities across at least seven states, including Minnesota where over 30 systems were hit. Experts say the pattern fits Iran's known playbook but attribution remains difficult.
Imagine someone sneaking into a bunch of water plants across America and messing with the computers that keep the water flowing. The US is now looking into whether hackers from Iran did it, or if other bad actors pretended to be from Iran to cause trouble.
Analysis
Minnesota First, Then Six More States
Last week, Minnesota authorities disclosed that more than 30 water utilities in the state had been hit in a coordinated cyberattack, an unusually large number for a single incident. Days later, the FBI confirmed that intrusions had been reported in seven states in total and that some of them had disrupted the operational technology at water facilities. The Cybersecurity and Infrastructure Security Agency (CISA), which is leading the federal review, has declined to comment on attribution. President Donald Trump, who used a cabinet meeting to call Minnesota officials "highly incompetent" and blame them for the breach, has not publicly pointed the finger at Tehran. Governor Tim Walz, a Democrat, pushed back, saying Trump "knows exactly who is responsible" and that other states were hit too.
Attribution Is Hard, and Disinformation Is Part of the Game
Even though Trump has avoided naming Iran, multiple former US officials told the BBC that Tehran sits at the top of the suspect list. Morgan Wright, a former State Department counterterrorism adviser, said such low-level, disruptive attacks usually point to North Korea or Iran because of capability and motive. CBS News, the BBC's US partner, reported that investigators are also weighing whether the hackers impersonated an Iran-based group to sow confusion during the US-Iran war. Jake Brown, a former acting deputy director of the White House's national cybersecurity office, said the Trump administration may not want to publicly confirm an Iranian breach even if it has high confidence, because the White House itself is engaged in an information-warfare contest with Tehran. Iran has not commented on the latest incidents but has repeatedly denied involvement in past operations attributed to it, including 2016 attacks on US banks and a dam near New York.
Handala and a Pattern Stretching Back a Decade
BBC Verify's analysis shows that most of the cyber operations attributed to Iran against the US and Israel this year were carried out by a group called Handala, which the US Department of Justice has linked to Iran's Ministry of Intelligence. The FBI has accused Handala of accessing emails and personal data belonging to FBI director Kash Patel in the early days of the Iran war. Handala claimed responsibility in mid-June for breaching a California water utility in retaliation for a US strike on Iranian water infrastructure. Earlier incidents tied to Iranian or Iran-aligned actors include a 2024 operation against the US presidential campaign, 2023-2024 intrusions into water and wastewater systems by a group allegedly linked to the Islamic Revolutionary Guard Corps that briefly knocked out pressure controls at two Pennsylvania utilities, the 2020 charges against two Iranian nationals for election interference, and a multi-year ransomware campaign documented in 2017. Wright warned that Iran also leans on proxy groups abroad, which complicates attribution and gives Tehran room to deny.
Key points
- Minnesota reported more than 30 water utilities hit in a single coordinated cyberattack, with the FBI confirming incidents in seven states total.
- President Trump blamed Minnesota officials for the breach but has not publicly named Iran; experts told the BBC Tehran is the leading suspect.
- CBS News reported investigators are also considering whether the hackers impersonated an Iran-based group during the US-Iran war.
- BBC Verify found most Iran-attributed cyber operations against the US and Israel this year were carried out by the group Handala, which the US says acts on behalf of Iran's Ministry of Intelligence.
- Iran has not commented on the latest incidents and has historically denied involvement in cyber operations attributed to it.
If attribution points clearly to Iran and is made public, it could harden defenses at thousands of small and mid-sized US water utilities, many of which still run outdated industrial control systems. CISA and the FBI have used past incidents to push utilities toward better monitoring and segmentation, and a high-profile case could accelerate that work.
If the attacks succeed in disrupting service, even briefly, in multiple states, it would demonstrate that Iranian or Iran-aligned hackers can hit civilian infrastructure inside the US with relatively limited resources. Investigators also worry that copycat groups, or Iran-aligned actors operating abroad, will exploit the same poorly secured small-town utilities that are hardest to defend, and that political reluctance to name Iran publicly could delay a coordinated federal response.
