Cyberattack on US Water Systems: Seven States Affected; Iran Suspected

A cyberattack on water systems has hit seven states across the United States, and according to The New York Times, the damage may be even greater. The state of Minnesota was the first to report the attacks that hit the state's water systems, and Michigan joined it. There has been no official announcement about this in the US, but it appears that Iran is behind the operation.

Last Thursday, the FBI and the US Environmental Protection Agency (EPA) stated that at least seven US states had reported incidents in the water system to the FBI. The report stated that there were no signs of any damage to the water supply, but across the US, preparations were made for possible malfunctions in the computers that usually monitor water quality and the chemical levels in them.

Although it was reported in the US that such an attack has no precedent, ynet revealed back in 2020 that Iran had carried out a cyberattack on water facilities in Israel. That same year, a Western intelligence source revealed in the Financial Times that the goal of the attack was to raise the chlorine level in the water supplied to the homes of citizens in Israel. Four Israeli sources and one Western source told the newspaper at the time that the Iranians hacked into the software that operates water pumps in Israel after passing through American and European servers to hide the source of the code.

Either way, for now there is no certainty in the US that the cyberattack was carried out on behalf of Iran, and according to US authorities, the investigation is in its early stages. But according to the report, Iran has increased its cyberattacks since the war with Israel and the US, and in the past, the Iranians have tried to hit similar water facilities in the US. The New York Times noted that for now, it does not appear to be an attack on economic grounds, which reduces the chances that it is a criminal act.

President Donald Trump downplayed the magnitude of the event yesterday when asked about it. He blamed the state of Minnesota, which warned about the case quickly and led other states to check their water systems. "I think Minnesota is behind it," Trump said yesterday, "I don't believe there was an Iranian cyberattack." Minnesota Governor Tim Walz rejected Trump's claims and said: "This is what modern warfare looks like." After Trump's remarks, federal officials said in closed conversations that Iran remains the prime suspect, but explained that the investigation is in its early stages and there is still no conclusive evidence.

The US Cybersecurity and Infrastructure Security Agency (CISA) updated yesterday that the hackers targeted "water facilities of all sizes," and recommended that facilities disconnect from the internet controllers that could be affected. The cyberattack, the agency said, "led to boil water notices and ongoing manual operations." Former intelligence officials and cybersecurity experts said it is very likely that the hackers took advantage of an operational opportunity and did not choose specific cities to hit.

Tensions in the Middle East

The report comes amid rising tensions in the Middle East. After it was reported last night citing sources that the US and Israel are planning one of the most significant bombing operations to date in Iran over the weekend, CBS reported this evening citing an official Israeli source that "Israel is not aware of a decision to resume the military operation in full, and no request has been received in Israel to join military actions against Iran." The source made the remarks on condition of anonymity, while Israel maintains silence.

Meanwhile, American embassies in the region — including Bahrain, Iraq, Jordan, Kuwait, Lebanon, Oman, Qatar, Saudi Arabia, the UAE, Egypt, and also Israel — have issued security warnings to their citizens, and called on them to leave or be prepared to leave immediately following a possible escalation.