Here's the thing. Attackers targeted programmable logic controllers — the hardware that tells a water plant what to do — and changed passwords to lock out operators. Some facilities issued boil-water notices. Others shifted to manual operations. The city of Braham, Minnesota, population roughly 1,700, asked residents to minimize water use for a few hours on Monday after its well and water treatment plant went offline. Plymouth, a Minneapolis suburb of about 80,000, said its water infrastructure communications were restored by Tuesday afternoon.
By Saturday, Michigan had joined the list. Dale George, director of communications at Michigan's Department of Environment, Great Lakes, and Energy, said the state received 'a small number of reports from Michigan communities indicating activity consistent with what federal agencies described.' He later confirmed nine systems were affected. 'All systems continued to operate safely, issues were addressed by local operators, and there are no known impacts that posed a public health concern,' George said.
The Cybersecurity and Infrastructure Security Agency issued a nationwide alert to water utilities warning that cyber threat actors are specifically targeting programmable logic controllers and changing passwords to prevent operators from accessing their systems. CISA's guidance: disconnect those controllers from the open internet, and if remote access is required, route it through a VPN or gateway device.
Multiple U.S. officials told ABC News and the New York Times that Iran is the chief suspect. Braham Mayor Nate George told the Times that federal and local officials had 'little doubt about the likely culprit being Iran' but were 'reluctant to say so publicly.' The FBI acknowledged awareness of the intrusions and said it and 'interagency partners are fully engaged to protect critical infrastructure,' but declined to publicly assign responsibility.
Minnesota's chief information security officer, John Israel, said the federal government is 'evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor.' At least five other unidentified states have also been targeted, according to the New York Times.
At a cabinet meeting Friday at Camp David, President Trump offered a different read. 'We heard in Minnesota there was a cyberattack, and they blame it on Iran. I don't think so,' Trump said. 'I think I blame it on Minnesota because they're grossly incompetent.' Governor Tim Walz responded on social media, saying Trump 'knows exactly who is responsible for this attack, and knows that other states were hit too.'
Iran's interest in U.S. water infrastructure is not new. In 2016, the Justice Department charged a group of Iranian hackers in connection with a cyberattack targeting a small dam near New York City.
Voltage's read: The real story here is not attribution theater — it is that critical public infrastructure is running on systems that can be locked out by a password change. Braham Mayor Nate George put it plainly: 'IT infrastructure upgrades are very costly and we are a very small municipality.' That is the structural problem. Municipal water systems are underfunded, under-patched, and directly connected to the internet in ways that no serious security posture permits. Whether the actor is Tehran or anyone else, the vulnerability is American-made — and fixing it requires either federal investment or the kind of deregulatory flexibility that lets small utilities contract for modern security without drowning in compliance paperwork. The FBI can investigate. Someone needs to actually ship the patch.
