Michigan joins Minnesota as cyberattacks hit US water systems

Washington,UPDATED: Aug 2, 2026 01:36 IST

Michigan has joined Minnesota in reporting cyberattacks on water systems, with officials in the two US states saying multiple facilities were targeted. In Michigan, nine water systems were affected, but a state official said all of them continued to operate safely.

Authorities in Minnesota said earlier this week that more than 30 water systems had been targeted. The source of the attacks is under investigation, but the incidents come amid warnings from US agencies that Iranian hackers have been focusing on water and wastewater systems and other critical infrastructure controls.

The reports in Michigan came after the state received a federal cyber alert on Tuesday about attempts to tamper with technology used to run water systems. Soon after, the state received "a small number of reports from Michigan communities indicating activity consistent with what federal agencies described", said Dale George, director of communications at the state's Department of Environment, Great Lakes, and Energy. He later said nine systems were impacted.

"All systems continued to operate safely, issues were addressed by local operators, and there are no known impacts that posed a public health concern," George said in a statement.

The FBI is investigating the incidents, but it has not publicly identified who was responsible. A spokesperson declined to say on Thursday who the bureau thought might be behind them. In an advisory last week, the FBI, the Cybersecurity and Infrastructure Security Agency and other agencies warned that Iranian hackers had been targeting water and wastewater systems as well as the operational controls of other critical infrastructure sectors.

"The FBI is aware of recent public reporting around Water and Wastewater (WWS) sectors," the agency said in a statement on Saturday. "The FBI and our interagency partners are fully engaged to protect critical infrastructure and we remain well-equipped to protect against cyber threats of all varieties."

Cyber conflict has become a regular part of military tensions, and local water plants and healthcare facilities often do not have the money or expertise to install the latest software updates or take other security steps. That has made them frequent targets because they can be easier to breach and because any disruption can trigger public alarm.

Iran's interest in water system operations inside the US goes back several years. In 2016, the Justice Department charged a group of Iranian hackers in connection with a cyberattack targeting a small dam near New York City.

Minnesota IT Services said that, as of Thursday, there were no active requests from communities in the state asking residents to change their drinking water use. The agency said most of the confirmed attacks involved technology that water systems use to remotely monitor and control equipment. It said investigators had confirmed malicious activity involving system technology, but that did not mean every affected community had its water service disrupted.

For a few hours on Monday, the city of Braham asked residents to minimise water use while officials tried to find out why the water plant was offline. The city, home to about 1,700 people and located about 113 kilometres north of Minneapolis, later said in a news release that the outage was caused by a cyberattack, but added that there was no issue with water quality.

The city said the attackers shut down the operating controls that shut down the well and water treatment plant. As a result, Braham could for a time supply residents only with the water stored in its water tower.

In Plymouth, a city of about 80,000 outside Minneapolis, officials said on social media that communications linked to the city's water infrastructure had been restored by Tuesday afternoon after a cyberattack.

During a Cabinet meeting on Friday at the Camp David presidential retreat in Maryland, President Donald Trump claimed without evidence that the recent cyberattacks in Minnesota were the fault of the state, including Democratic Governor Tim Walz. Walz responded on social media, saying Trump "knows exactly who is responsible for this attack, and knows that other states were hit too".

The incidents in Michigan and Minnesota have put the focus on the vulnerability of local water systems to cyberattacks, even as officials say services have continued and there are no known public health concerns. Investigations into who carried out the attacks are continuing.

With PTI Inputs

- Ends