Leaked Memo Links Iran to Cyberattacks on Minnesota Water Utilities
Original: A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran
Why This Matters
State-sponsored targeting of civilian water infrastructure marks a significant escalation in Iran-linked cyber operations against the U.S.
A memo obtained by WIRED from WaterISAC links a series of cyberattacks targeting dozens of Minnesota water and wastewater utilities to Iran. More than 30 municipal systems were breached, with at least one city, Braham (pop. 1,700), experiencing a brief water plant outage.
A WaterISAC communication obtained by WIRED on July 30, 2026 ties a wave of cyberattacks on Minnesota water and wastewater utilities to Iran. The memo references an alert from the Minnesota Fusion Center describing "ongoing malicious cyber activity impacting public drinking water systems across Minnesota," and links the attacks to an Iran-affiliated hacking campaign previously identified by CISA in April 2026. More than 30 municipal systems were targeted, with intrusions disabling communications between industrial control systems and utility equipment. In the city of Braham (population 1,700), hackers reportedly caused a brief outage at the water plant. CISA released a new advisory Thursday warning that "these threat actors are targeting water entities of all sizes" and urging utilities to disconnect PLCs from the internet and enforce strong password protections. The attacks follow a broader pattern of Iranian retaliatory cyber operations since the U.S. launched military action against Iran in late February 2026, which previously included breaches at medical supplies company Stryker and the personal email of FBI Director Kash Patel. Joe Slowik, a cybersecurity researcher formerly of Los Alamos National Labs, noted that the attacks represent "documented disruption and even modification of safety and protection parameters in critical infrastructure," and warned that other sites with similar technology remain at risk.