Blab Tech
Michigan and Minnesota Report Cyberattacks on Water Systems; FBI Warns of Nationwide Threat
On August 2, 2026, Michigan officials confirmed that nine municipal water systems in the state had been targeted by cyber intrusions, adding to a growing list of U.S. states that have reported attacks on water infrastructure.
The incidents followed a wave of activity on July 26‑27 that affected more than 30 community water systems in Minnesota. The Federal Bureau of Investigation (FBI) has said that at least five other states have also been impacted.
Michigan’s Department of Environment, Great Lakes and Energy (EGLE) director of communications, Dale George, said the state received a small number of reports after a federal cyber alert was issued on July 25. George noted that the reports were consistent with the FBI’s description of malicious activity aimed at operational technology (OT) devices. He added that all nine systems continued to operate safely, that local operators addressed the incidents, and that there were no known public‑health impacts.
Minnesota’s response mirrored Michigan’s. State officials said that the intrusions targeted OT used for remote equipment monitoring and control. An “impacted” system experienced confirmed cyber activity, but the state has not reported any service disruptions for residents. The Minnesota Department of Health has stated that drinking water has not been compromised.
The FBI’s warning, posted on Twitter (X) on July 31, described the threat as “malicious cyber actors” who are remotely accessing internet‑facing programmable logic controllers (PLCs), changing IP addresses and passwords, and causing operational disruption, including pressure loss and flooding. The agency said it is fully engaged with interagency partners to protect critical infrastructure.
The attacks have drawn attention to the vulnerability of small water utilities. According to the U.S. Environmental Protection Agency, 97 percent of the nation’s 156,000 public water systems serve fewer than 10,000 people, many of which rely on legacy OT that is difficult to secure.
While the FBI has not attributed the attacks to a specific actor, several media outlets have cited Iranian‑linked hackers as a likely source. The New York Times reported that Iranian cyber groups have shown interest in U.S. water systems for years, and the Associated Press noted that Iranian hackers have been active in the water and wastewater sector. No official investigation has confirmed this link.
President Donald Trump reacted to the reports during a Cabinet meeting at Camp David on Friday. In the meeting, Trump criticized Minnesota Governor Tim Walz and the state’s leadership, calling them “grossly incompetent.” The president’s remarks were not accompanied by any new evidence or attribution.
The FBI’s statement emphasized that the agency remains well‑equipped to defend against cyber threats of all varieties. No public‑health advisories have been issued, and local operators have maintained service continuity.
The incidents underscore the growing risk to critical infrastructure from state‑sponsored or organized cyber actors. The FBI, EPA, and state agencies are continuing to investigate the source of the attacks and to strengthen defenses across the nation’s water utilities.
As of now, the investigations are ongoing, no definitive attribution has been made, and the water systems in Michigan and Minnesota remain operational. Officials continue to monitor the situation and are coordinating with federal partners to prevent further intrusions.
The incidents followed a wave of activity on July 26‑27 that affected more than 30 community water systems in Minnesota. The Federal Bureau of Investigation (FBI) has said that at least five other states have also been impacted.
Michigan’s Department of Environment, Great Lakes and Energy (EGLE) director of communications, Dale George, said the state received a small number of reports after a federal cyber alert was issued on July 25. George noted that the reports were consistent with the FBI’s description of malicious activity aimed at operational technology (OT) devices. He added that all nine systems continued to operate safely, that local operators addressed the incidents, and that there were no known public‑health impacts.
Minnesota’s response mirrored Michigan’s. State officials said that the intrusions targeted OT used for remote equipment monitoring and control. An “impacted” system experienced confirmed cyber activity, but the state has not reported any service disruptions for residents. The Minnesota Department of Health has stated that drinking water has not been compromised.
The FBI’s warning, posted on Twitter (X) on July 31, described the threat as “malicious cyber actors” who are remotely accessing internet‑facing programmable logic controllers (PLCs), changing IP addresses and passwords, and causing operational disruption, including pressure loss and flooding. The agency said it is fully engaged with interagency partners to protect critical infrastructure.
The attacks have drawn attention to the vulnerability of small water utilities. According to the U.S. Environmental Protection Agency, 97 percent of the nation’s 156,000 public water systems serve fewer than 10,000 people, many of which rely on legacy OT that is difficult to secure.
While the FBI has not attributed the attacks to a specific actor, several media outlets have cited Iranian‑linked hackers as a likely source. The New York Times reported that Iranian cyber groups have shown interest in U.S. water systems for years, and the Associated Press noted that Iranian hackers have been active in the water and wastewater sector. No official investigation has confirmed this link.
President Donald Trump reacted to the reports during a Cabinet meeting at Camp David on Friday. In the meeting, Trump criticized Minnesota Governor Tim Walz and the state’s leadership, calling them “grossly incompetent.” The president’s remarks were not accompanied by any new evidence or attribution.
The FBI’s statement emphasized that the agency remains well‑equipped to defend against cyber threats of all varieties. No public‑health advisories have been issued, and local operators have maintained service continuity.
The incidents underscore the growing risk to critical infrastructure from state‑sponsored or organized cyber actors. The FBI, EPA, and state agencies are continuing to investigate the source of the attacks and to strengthen defenses across the nation’s water utilities.
As of now, the investigations are ongoing, no definitive attribution has been made, and the water systems in Michigan and Minnesota remain operational. Officials continue to monitor the situation and are coordinating with federal partners to prevent further intrusions.
