A wave of cyberattacks against American water and wastewater facilities is raising questions about whether Iran may be engaging in asymmetric tactics to pressure the United States to end its blockade in the Strait of Hormuz, or simply punish Washington for devastating its nuclear program.
Water utilities in at least seven states have reported cyber incidents to the FBI since late July, with more than 30 community water systems being targeted in Minnesota alone.
President Donald J. Trump signs Executive Orders in the Oval Office, Wednesday, June 3, 2026. (Official White House Photo by Molly Riley)
President Donald J. Trump meets with his cabinet at Camp David, Maryland on Friday, July 31, 2026. (Official White House Photo by Daniel Torok)
Some of those attacks have caused genuine operational problems, including loss of water pressure and flooding, while others have seen operators temporarily lose remote control of equipment.
And as the attacks keep coming, some analysts are now looking to Iran.
Cybersecurity experts and intelligence assessments seem to suggest that Iranian-linked actors could be behind the attacks, but as of yet, the U.S. government has not formally attributed the attacks to Iran.
So, what’s going on?
More Than 30 Water Systems Hit In Minnesota
On July 30, the FBI confirmed that water and wastewater facilities in at least seven states had reported cyber incidents beginning around July 27.
Minnesota was among the worst hit.
Minnesota IT Services (MNIT), the state government agency responsible for IT and cybersecurity services, said attackers targeted operational infrastructure and technology at more than 30 community water systems during a two-day coordinated campaign.
In Braham, a city of around 1,700 people, operators discovered that a pump at the water treatment plant was not working.
Residents were temporarily asked to conserve water while crews switched to stored supplies and manually regained control of the pump. Similar incidents were reported elsewhere, including Michigan, New Jersey, and Georgia.
According to the FBI, hackers gained access to internet-facing programmable logic controllers (PLCs), which are industrial computers used to operate physical equipment within the water plants.
The attackers changed passwords and network settings and, in some instances, prevented workers from remotely controlling equipment.
Investigators Point to Iran
Hacks like this are nothing new, but it’s still unclear who is responsible.
The FBI has not publicly attributed the campaign to any country or hacking group, and neither Tehran nor any known Iranian-linked hacking organizations have claimed responsibility yet.
But some experts believe that all signs point to Iran. NPR reported on August 12 that one cybersecurity expert familiar with sensitive intelligence said that there was information connecting the hacks to Iran’s Islamic Revolutionary Guard Corps (IRGC).
“It was opportunistic, but was almost certainly a result of the war,” the anonymous expert claimed.
Meanwhile, Jake Braun, the former acting principal deputy national cyber director at the White House, came to the same conclusion, telling NPR that “it appears this is a shot across the bow from Iran.”
Braun’s assessment is the closest we have gotten to an official explanation.
U.S. Agencies Have Warned About Iranian Hackers
The suspicions follow a series of warnings issued by U.S. agencies in recent months.
In April, the Cybersecurity and Infrastructure Security Agency (CISA) published an advisory warning about Iranian-linked hackers who were searching for vulnerable industrial equipment, specifically the kind used by U.S. water systems. That advisory was updated shortly before the latest attacks began.
The methods being used also appear to be relatively straightforward.
Investigators say that attackers have targeted equipment that is directly connected to the internet, including devices protected by default usernames and passwords that operators had never changed.
It means that hackers were able to interfere with physical equipment without necessarily defeating any sophisticated cybersecurity defenses.
Iran Has Targeted U.S. Water Before
The suggestion that Iran may be behind the attacks makes sense when one considers the fact that Iran has targeted U.S. water before.
In 2023, the Iranian-linked CyberAv3ngers group breached industrial equipment at a water facility located in Aliquippa, Pennsylvania, during the Israel-Hamas war.
The attackers targeted equipment that contained Israeli-made components and manipulated it to display an anti-Israel message.
The latest round of attacks, however, appears strangely broad.
Also speaking to NPR, Rob Lee, the CEO of industrial cybersecurity company Dragos, said that he was aware of victims outside of the water industry. He said that he couldn’t recall a time when so many targets have been hit at once.
Is This Part Of Iran’s War Strategy?
If Iran is ultimately determined to be the source of the attacks, the timing suggests that it is a response to the ongoing blockade of Iran-linked ships in the Strait of Hormuz and the U.S. campaign to pressure Iran to dismantle its nuclear program.
Iran has already survived successive waves of intense U.S. strikes against military infrastructure and may now be looking for new asymmetric strategies to pressure Washington to back down.
Cyber operations like this are a comparatively inexpensive way to impose costs inside the United States without launching a conventional attack on American territory.
They are, however, limited in scope, and unless they are prolonged and become more sophisticated, they are unlikely to move the needle.
About the Author: Jack Buckby
Jack Buckby is a British researcher and analyst specializing in defense and national security, based in New York. His work focuses on military capability, procurement, and strategic competition, producing and editing analysis for policy and defense audiences. He brings extensive editorial experience, with a career output spanning over 1,000 articles at 19FortyFive and National Security Journal, and has previously authored books and papers on extremism and deradicalization.
