FBI Probes Minnesota Water Sabotage

More than 30 Minnesota towns just learned that the taps delivering their drinking water can be quietly hijacked from a keyboard hundreds or thousands of miles away.

Story Snapshot

Over 30 community water systems in Minnesota were hit in a coordinated cyberattack on July 26–27, targeting the machines that move and treat water, not just office computers.
Federal Bureau of Investigation (FBI) agents and state officials are probing possible links to Iranian hackers after recent warnings that Iran-focused groups are eyeing U.S. water and wastewater systems.
Cities kept water safe by switching to manual controls, but the incident exposed how easily critical services can be disrupted with limited transparency or accountability.
Experts say the attack pattern matches earlier operations tied to Iran’s CyberAv3ngers ecosystem, but no government agency has formally named a culprit yet.

A coordinated attack on Minnesota’s water systems

Between Sunday, July 26, and Monday, July 27, a coordinated cyberattack struck operational technology at more than 30 community water systems across Minnesota. State officials said technology that remotely monitors and controls pumps, wells, water towers, and wastewater lift stations was targeted, disrupting digital controls that keep water moving. Minnesota IT Services described the event as a “coordinated cyberattack” on community water-system technology and launched a statewide cybersecurity response with local utilities.

Several cities went public about what happened. Braham reported that its water plant suddenly went offline, later confirming “a malicious cyber-attack of computerized operating systems by unknown actors” that shut down its operating controls and forced a temporary halt to water treatment. Plymouth said the hack hit two water towers and multiple wastewater lift stations connected through cellular links. South St. Paul and Maple Plain also confirmed similar incidents involving their utility systems and water supply technology.

How officials contained the damage and kept taps running

City and state officials emphasize that drinking water quality stayed safe throughout the incident. Braham said there were no physical problems at the plant and no impact on water quality or safety. Minnesota IT Services reported no active requests for residents to change drinking-water usage, and most confirmed attacks did not require boil-water advisories. In some communities, staff switched systems to manual override to keep water flowing while the digital controls were down, highlighting the value of old-fashioned backup methods.

The FBI, Minnesota IT Services, and the Minnesota Department of Health are now assessing the affected systems and studying the malware and access methods used. Officials say there are clear similarities in timing and targeted technology across the incidents, but they have not yet determined whether one single actor is behind every intrusion. This leaves many residents with a worrying picture: the government can say water is safe today, but it cannot yet clearly explain who broke in or how to stop them next time.

Iranian hacker warnings and the CyberAv3ngers connection

The Minnesota attacks came just days after federal agencies warned that hackers tied to the government of Iran were focusing on water and wastewater systems and other critical infrastructure sectors. A joint advisory from the Cybersecurity and Infrastructure Security Agency and partners described Iranian-affiliated groups exploiting industrial controllers that run pumps and valves in these facilities. That warning is one key reason investigators and reporters quickly asked whether the Minnesota intrusions might be part of that same campaign.

Security researchers at Tenable, a private cybersecurity firm, say the timing and operational pattern of the Minnesota incident line up with activity from a threat ecosystem known as CyberAv3ngers, which the U.S. government has previously linked to Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command. They point to past attacks on government, water, wastewater, and energy sectors that used similar methods to interfere with industrial controllers. However, state and federal officials have not publicly attributed the Minnesota attacks to any specific group or country, and investigators caution that current assessments are still preliminary.

What this reveals about fragile infrastructure and public trust

For many Americans, this story hits a nerve that goes beyond party lines. People across the political spectrum already worry that federal and state leaders have allowed critical infrastructure to become a soft target, even as money flows to bureaucracy, special interests, and overseas priorities. Here, more than 30 water systems were compromised, yet residents mainly learned that “everything is fine” while details on the attackers, exploited weaknesses, and long-term fixes remain limited.

Cyberattacks on Minnesota water systems investigated as officials warn about Iranian hackers https://t.co/UXcfqZy9Za pic.twitter.com/CYpKtlmewg

— This Is The Conversation Project (@th_conversation) July 31, 2026

Experts note that small municipal utilities often rely on low-cost, internet-facing industrial gear and consumer-grade cellular modems to run vital systems. These choices save money up front but create doorways for foreign hackers or criminal groups to reach deep into American communities with little effort. When Washington warns about Iranian hackers while local plants scramble to switch to manual controls, it reinforces a growing belief that the government reacts after the fact instead of building real resilience. Many see this as another sign that the “deep state” protects itself with reports and advisories, while everyday families live with the risk.