Water cyberattack hits at least 7 states

Key Points:

• A coordinated cyberattack targeted operational technology at more than 30 community water systems across seven states, including Minnesota, on July 26-27, causing one plant to temporarily go offline and prompting manual operations elsewhere.
• Investigators preliminarily suspect Iranian hackers behind the attack, though this attribution is not confirmed and U.S. officials caution the assessment may change as more evidence is gathered.
• The cyberattack highlights vulnerabilities in U.S. water utilities, especially smaller communities with limited cybersecurity resources and outdated technology, raising concerns about the ability to maintain safe water operations during such incidents.
• Federal agencies like CISA recommend isolating vital operational technology from less trusted networks and strengthening security measures such as changing default passwords and limiting remote access to reduce risk.
• Residents are advised to follow official updates, avoid assuming contamination without confirmation, enable emergency alerts, keep emergency water supplies, and be cautious of scams during any water utility cyber incident.