'Coordinated Cyberattack' Hits More Than 30 Minnesota Water Systems

Authored by Owen Evans via The Epoch Times,

A “coordinated cyberattack” targeted more than 30 community water systems ‌in Minnesota on July 26 and July 27, the state’s information technology agency said in a statement.

Minnesota IT Services (MNIT) stated on July 28 that it activated its incident response capabilities immediately after learning of the attack. MNIT stated that an investigation remains active, and responders continue to “assess affected systems.”

“At this time, they are not aware of any active requests from Minnesota cities to have their residents modify their drinking water usage,” the agency stated.

John Israel, MNIT assistant commissioner and Minnesota chief information security officer, said such attacks require “a coordinated, whole-of-government response.”

“[The agency] is working side by side with our partners to share intelligence, support affected communities, and help utilities restore operations safely while strengthening defenses against future attacks,” he said.

Emily Zimmer, a spokesperson for the agency, told Reuters in an email that while the investigation remains ongoing, “the timing, methods of access, and targeted infrastructure share characteristics with other coordinated cyber incidents our federal partners have observed involving critical infrastructure.”

Zimmer said the agency could not yet discuss formal attribution or specifics of the incidents. She noted that ‌the agency used the term “attack“ to describe the situation ”because investigators identified unauthorized access with malicious intent directed at these systems.”

The FBI said in a statement that it ‌was ⁠aware of the incident and was in contact with the victims “to resolve the matter.”

In a June 16 article about safeguarding critical water infrastructure, Microsoft stated that while cyberattacks typically “wreak havoc” on digital systems, at a water utility, a network breach “can move quickly into the physical realm.”

“Online systems can give an attacker access to operational technology—physical equipment like pumps, sensors, and chemical treatment systems,” it stated.

It stated that local utilities make prime targets because of their size and that most U.S. water utilities are tiny operations.

According to the Environmental Protection Agency (EPA), 97 percent of the nation’s 156,000 public water systems serve fewer than 10,000 customers.

While it is not yet clear who is responsible for the attacks, Iranian-linked hackers have, for years, targeted U.S. water systems to varying levels of success.

Handala Warning

Iran’s state-run Press TV, which the U.S. Treasury has sanctioned for acting as a propaganda arm of the Islamic Revolutionary Guard Corps, reported on July 23 that the Handala hacking group warned that it will continue targeting U.S. industrial control systems.

Handala is one of several public personas used by a hacking unit operating ​under the Iranian Ministry of Intelligence and Security (MOIS) as part of the agency’s psychological ⁠operations, according to the U.S. Department of Justice.

An April 7 U.S. Cybersecurity and Infrastructure Security Agency (CISA) ​advisory warned that Iranian-affiliated ​hackers were attacking internet-facing ⁠programmable logic controllers, computer devices used to interact with machinery and other critical infrastructure networks, manufactured by Rockwell Automation.

The group said on July 23 that attacks targeting programmable logic controllers and supervisory control and data acquisition systems represented only a portion of its capabilities and warned that wider campaigns could target sectors including water, electricity, and transportation networks, Press TV reported.

A July 22 update to the advisory expanded the ​scope of the targeting to include devices manufactured by Schneider Electric, Siemens, and ​potentially other manufacturers.

CISA stated in its advisory that some hacking activity resembles operations previously attributed to CyberAv3ngers, also known as the Shahid Kaveh Group, which is affiliated with the Cyber Electronic Command of Iran’s Islamic Revolutionary Guard Corps.

CISA acting Director Nick Andersen told The Epoch Times by email: “CISA is aware of multiple potential incidents affecting local water utilities and is coordinating with the EPA and other government and industry partners to understand the scope and provide any information or technical support to help critical infrastructure owners and operators protect their systems.”

On June 11, the cybersecurity company Dataminr issued an alert about Handala, stating that the hacking group had claimed to have compromised California Water Service (Cal Water), one of the largest investor-owned water utilities in the United States, serving approximately 2 million customers across 100 California communities. The hackers published 5 gigabytes of data.

“CISA’s ⁠updated reporting shows a worrying expansion in Iran-linked critical infrastructure targeting focused on the United States,” Joe Slowik, director of threat research and cyber engineering at Dataminr, said in a July 27 blog post on the company’s ⁠website.

CyberAv3ngers struck a small water utility in Aliquippa, Pa., in November 2023, gaining control of a device at the Municipal Water Authority, according to a 2025 report by the Maryland Cybersecurity Council.

Cyberattacks on Water Systems

According to Xylem, a global water technology provider, there’s “no lack of examples” of cyberattacks involving water systems.

In October 2024, New Jersey-based American Water, the largest regulated water and wastewater utility company in the United States, which serves more than 14 million people in 14 states and on 18 military installations, had to shut down computer systems due to a cyberattack.

In January 2024, the Russian hacktivist group Cyber Army of Russia Reborn claimed responsibility for attacks on water facilities in the United States and Poland. In Muleshoe, Texas, one breach resulted in the loss of tens of thousands of gallons of water.

Authorities have assessed that a Chinese Communist Party state-sponsored cyber group known as Volt Typhoon is seeking to pre-position itself on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure.

In a 2024 statement, CISA said that Volt Typhoon uses hacking techniques that avoid installing malware, which can be relatively easily detected, and instead rely on built-in tools that are harder to spot.

This means that they exploit weak admin passwords, factory-default logins, and unpatched internet-connected devices

In a January report from the Congressional Research Service, Chris Jaikaran, a specialist in cybersecurity policy, said that the U.S. Intelligence Community assesses that China is “the most active and persistent cyber threat” to U.S. institutions.