A leaked memo, issued by the water utilities information sharing group WaterISAC, links dozens of cyberattacks against Minnesota water utilities to Iran

A memo obtained by WIRED, issued by the water utilities information sharing group WaterISAC, links dozens of cyberattacks against Minnesota water utilities to Tehran.

Wired 2026-07-31 Andy Greenberg

Context & Ripple Effects

The WaterISAC memo adds a state-level cluster to April warnings that Iran-linked actors had targeted industrial-control devices in US water and energy systems, including the federal warning on water and energy control systems.

It also extends a longer record of water-sector cyber exposure: federal agencies previously disclosed ransomware incidents at water treatment plants across several states. The significance here is the reported concentration of activity against Minnesota utilities and its attribution by the sector’s information-sharing group.

First-order effects

Minnesota water utilities named or implicated by the memo must treat the activity as a coordinated threat pattern, accelerating review of internet-facing industrial-control systems, access credentials, and incident reporting.
WaterISAC’s attribution gives member utilities and public-sector defenders a common basis for sharing indicators and prioritizing Iran-linked activity over isolated-event handling.

Second-order effects

Other US water operators are likely to compare their environments with the Minnesota cases and the earlier agency alert on Iran-linked critical-infrastructure targeting, raising demand for industrial-control monitoring and response support.
The reported cluster increases pressure on equipment operators, managed-service providers, and local governments to clarify who can detect and respond to intrusions spanning business networks and operational systems.

Third-order effects

If repeated targeting continues, water cybersecurity will be treated less as a series of local IT incidents and more as a national critical-infrastructure resilience problem requiring sector-wide intelligence sharing.
The pattern reinforces a broader shift toward defending operational technology as a strategic target, though the memo alone does not establish how durable or geographically broad the campaign is.

The trend: Iran-linked activity is increasingly testing the security and coordination capacity of distributed US critical-infrastructure operators, especially those running industrial-control environments.

Discussion

@couts Andrew Couts on bluesky
NEW: An industry memo obtained by @wired.com links dozens of cyberattacks on Minnesota's water system to Iran-backed hackers. Clues point to the IRGC's Cyb3rAvengers group, but other details point to another group, Handala. No official attribution has been made. @agreenberg.bsk…
@agreenberg Andy Greenberg on bluesky
A Minnesota state fusion center report ties the cyberattacks on 30+ Minnesota water utilities to Iranian-affiliated hackers, according to a water utility information sharing group's memo I obtained. — www.wired.com/story/a-leak...
@bancsutherland Bancroft Sutherland on bluesky
Iran going after Bluesky and Minnesota really raises some resource allocation questions.
r/minnesota r on reddit
A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran
r/PLC r on reddit
CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs
r/Economics r on reddit
U.S. Sees Iran as Likely Behind Cyberattack on Minnesota Water Systems
r/water r on reddit
U.S. Sees Iran as Likely Behind Cyberattack on Minnesota Water Systems
Qasim Ali Qasim Ali on linkedin
🚨 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗦𝗲𝗰𝘂𝗿𝗶𝘁 …
@jacquiheinrich Jacqui Heinrich on x
President Trump at Camp David tells reporters he does not believe preliminary assessment that Iran is likely behind MN city water cyber attacks. POTUS: “We heard in Minnesota there was a cyber attack, and they blame it on Iran. I don't think so. I think I blame it on Minnesota be…
@foxnews @foxnews on x
JUST IN: President Trump pushes back on state officials blaming Iran for a recent cyber attack …
@tom_winter Tom Winter on x
We're now up to 7 states that have had their water or wastewater systems impacted.
@rvawonk Caroline Orr Bueno, Ph.D on x
In the past 3 years, Iran has launched cyberattacks targeting dozens of U.S. water and energy facilities, across at least seven states, involving thousands of individual intrusion attempts. This is what they do. It's not about Minnesota; it's about Americans.
@atrupar Aaron Rupar on x
Trump: “We heard in Minnesota there was a cyberattack and they blame it on Iran. I don't think so. I blame it on Minnesota because they're grossly incompetent. Iran's got bigger problems than worrying about Minnesota.” [video]
@campuscodi.risky.biz Catalin Cimpanu on bluesky
It is literally Iran, yet this clown is lying for political points [embedded post]
@dnvolz Dustin Volz on x
It's important to note the FBI's own public service announcement, published late Thursday evening, prominently notes “at least seven states” have reported since last weekend attempts to compromise water systems (Rockwell PLCs) “and some of that activity degraded water operations”…

Chronicles