FBI Probes Water System Cyberattacks Affecting Michigan and Minnesota

Michigan reported Saturday that nine of its water systems sustained cyberattacks, marking the second state to disclose such breaches in recent days. Officials said all affected systems continued operating without compromising public safety, though the FBI has launched a formal investigation into the incidents.

Minnesota authorities earlier disclosed that more than 30 water systems in that state fell victim to similar attacks. The cyberattacks arrived shortly after federal agencies issued a warning Tuesday about attempts to interfere with operational technology controlling water infrastructure across the nation.

Dale George, communications director for Michigan’s Department of Environment, Great Lakes, and Energy, stated that local water operators resolved the detected issues immediately. “All systems continued to operate safely, issues were addressed by local operators, and there are no known impacts that posed a public health concern,” George said in a statement.

The FBI, working alongside the Cybersecurity and Infrastructure Security Agency and federal partners, has not publicly identified a responsible party. However, multiple agencies warned last week that Iranian hackers have systematically targeted water and wastewater systems alongside other critical infrastructure.

Smaller municipalities and rural water utilities often lack resources to maintain current security protocols and software updates, making them attractive targets for state-sponsored actors. Such breaches risk widespread panic despite minimal immediate danger to water quality or service delivery.

Iran’s focus on American water infrastructure dates to at least 2016, when the Justice Department charged Iranian hackers for breaching a dam near New York City. Minnesota officials noted that most confirmed intrusions involved remote monitoring and control systems rather than direct disruptions to water service.

The city of Braham, Minnesota, with approximately 1,700 residents located 70 miles north of Minneapolis, asked residents to minimize water consumption Monday after attackers disabled operational controls at its treatment plant. Plymouth, a city of roughly 80,000 residents outside Minneapolis, restored its water infrastructure communications by Tuesday afternoon following a similar breach.

President Donald Trump claimed without substantiation at a Camp David meeting Friday that Minnesota Governor Tim Walz bore responsibility for the attacks. Walz countered on social media that Trump “knows exactly who is responsible for this attack, and knows that other states were hit too.”