Federal authorities and state intelligence analysts are actively investigating a potential connection to Iranian state-backed hackers following a series of coordinated cyberattacks targeting municipal water systems across Minnesota.

According to U.S. and state officials, approximately three dozen local water utilities detected unauthorized intrusion attempts aimed at automated systems used to remotely monitor and manage water towers and treatment facilities. The breach attempts forced at least one city to temporarily take its water treatment plant offline for roughly ninety minutes, while other municipalities relied on manual operational workarounds. State officials confirmed that no public drinking water supplies were contaminated or compromised.

Digital Escalation Amid Overseas Conflict

While federal investigators caution that formal attribution remains ongoing, cybersecurity experts and state officials note that the tradecraft and lack of any financial ransom demand closely match recent activity by Iranian actor groups, including the state-aligned collective known as CyberAv3ngers.

The suspected cyber intrusion comes amid heightened military hostilities between the United States and Iran in the Middle East. Federal agencies, including the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation, had previously warned operators of critical national infrastructure to heighten defensive postures against potential Iranian cyber retaliation targeting industrial control devices.

Minnesota’s Chief Information Security Officer, John Israel, stated that early detection in Minnesota allowed quick alerts to be issued to other jurisdictions, noting that similar scanning and threat activity may be occurring in other states nationwide. Federal law enforcement continues to collect technical data to verify whether the breaches were directly directed by Tehran.