Cyberattacks aimed at municipal water systems have surfaced in at least seven states this week, pushing the FBI and the Environmental Protection Agency to sound an alarm to utilities across the country: hackers are actively probing critical water infrastructure, and some are succeeding.

In a public service announcement issued Thursday, the two agencies confirmed that water and wastewater utilities have reported incidents directly to the FBI, with certain intrusions already degrading day-to-day operations. Notably, the announcement stopped short of naming which states were affected — leaving the full scope of the threat somewhat obscured, even as its urgency was made crystal clear.

Minnesota's Breach and Its Iranian Fingerprints

More Than 30 Facilities Hit

This nationwide warning follows closely on the heels of an attack that struck more than 30 municipal water facilities in Minnesota — an intrusion that, according to a law enforcement official, carried the telltale hallmarks of Iranian-linked interference. The investigation remains active, with officials still piecing together the full picture.

No Contamination, But Real Disruption

A spokesperson for Minnesota's information technology services agency said Thursday there was no indication the breaches had contaminated any municipal water supply — a critical distinction that separates disruption from disaster. Still, the federal Cybersecurity and Infrastructure Security Agency noted in a separate alert that some larger-scale attacks on water infrastructure nationally had "resulted in boil water notices and sustained manual operations," though it declined to specify exactly where those more severe incidents occurred.

Neither Minnesota officials nor the federal government have formally pinned the state's breach on a specific actor. The FBI and EPA were similarly tight-lipped about identifying culprits behind the incidents in other affected states, leaving attribution as an open question hovering over the entire situation.

Political Sparks Fly Over Who's to Blame

Trump Points Fingers at Minnesota's Leadership

President Donald Trump, speaking to reporters Friday at Camp David, redirected blame squarely toward Minnesota's state government and Gov. Tim Walz, the 2024 Democratic vice presidential nominee.

"I think I blame it on Minnesota because they're grossly incompetent," Trump said. "I would blame it on Minnesota and the governor, the corrupt governor of Minnesota. They like to say, 'Oh, it's Iran.' Iran should be so lucky. Iran's got bigger problems than worrying about Minnesota."

Walz Fires Back

Walz didn't let the comment slide. Responding to a request for comment, he said in part: "Trump knows exactly who is responsible for this attack, and knows that other states were hit too. This is what modern warfare looks like, and it further illustrates there's no plan to win a war with Iran" — a rebuttal that reframed the entire episode as a symptom of a much larger, unresolved conflict.

What the Hackers Actually Did

Setting the political sparring aside, the FBI and EPA advisory focused primarily on tactics rather than attribution. According to the federal notice, the malicious cyber actors — referred to in the advisory as MCAs — specifically targeted certain brands of control systems commonly used by municipal water utilities. Even so, both agencies urged operators of all systems, regardless of brand, to take precautionary steps immediately.

Wisconsin Sounds Its Own Alarm

Earlier in the week, the Wisconsin Department of Natural Resources issued a bulletin to water system contacts statewide, warning that intelligence officials believed "systems within Wisconsin may be susceptible to connections from malicious cyber actors."

"This leads us to believe that the cyber threat is ongoing in Wisconsin and requires immediate action to prevent potentially serious impacts to our systems," the bulletin stated — language that read less like routine caution and more like an active fire alarm.

A department spokesperson later clarified that intelligence officials "had not yet confirmed that systems in Wisconsin have had connections but are concerned that they might be susceptible" — a distinction between confirmed breach and plausible vulnerability that mattered greatly to how residents should interpret the warning.

Details Minnesota Didn't Share Publicly

Wisconsin's bulletin went further than Minnesota's own public statements, revealing that Minnesota had reported hackers successfully dropping system pressures — incidents that, in several cases, triggered alarms and prompted direct law enforcement response. The bulletin warned that if pressure dropped low enough, it "could result in a full system shutdown" or even contamination — a chilling possibility that Minnesota's own public statements had notably left out. The state's information technology agency spokesperson did not immediately respond when asked about Wisconsin's more detailed account.

A Broader Pattern Amid Rising Tensions

These warnings arrive against the backdrop of an escalating military conflict involving Iran, at a moment when the United States has struggled to find an exit path from a war it launched alongside Israel — a geopolitical backdrop that makes infrastructure vulnerabilities feel less like isolated glitches and more like calculated pressure points.

How the Intrusions Worked

According to the agencies, the hackers gained remote access to internet-facing devices, altered IP addresses and passwords, and in the process stripped utilities of their ability to monitor and control their own systems — a digital version of someone quietly rearranging the locks on a building while the owners were looking the other way.

Recommended Defenses

The federal advisory urges system operators to pull programmable logic controllers, known as PLCs, out of direct internet exposure entirely, tucking them behind secure gateways and firewalls instead. It also recommends enforcing strong password practices and restricting communication between authorized control system devices through access control lists — essentially building layered barriers rather than relying on a single point of defense.

"Attribution requires careful analysis of technical evidence alongside broader national and international threat intelligence, and our federal partners are best positioned to lead that work," said Emily Zimmer, a spokesperson for Minnesota's information technology agency, signaling that the deeper investigative work remains squarely in federal hands.

A Pattern That Predates This Week

Minnesota's breach emerged just days after U.S. officials had already publicly flagged Iran-backed hackers as a threat to the nation's critical infrastructure amid the intensifying conflict between Washington and Tehran. In a July 22 advisory, the Cybersecurity and Infrastructure Security Agency, alongside the FBI and other federal partners, had urged companies to shore up their defenses, warning that Tehran-linked hackers were actively attempting to breach automated devices used to manage infrastructure systems.

U.S. intelligence agencies have also previously cautioned that Iran's capability and willingness to launch aggressive cyber operations has been steadily growing, pointing back to a 2023 attempt to target water systems as an earlier warning sign that largely went unheeded.

An Expert's Blunt Assessment

Bryson Bort, founder of the cybersecurity firm Scythe and an expert in industrial control system security, said this week's disclosures underscore just how urgently the public needs to grasp the stakes involved.

"We need to be prepared," Bort said. "Attacks like this illustrate that there are folks who mean the U.S. harm today" — a stark reminder that the threat isn't hypothetical, distant, or confined to headlines about foreign wars, but is quietly testing the pipes and pressure valves beneath American communities right now.