Braham residents learned Monday how quickly a foreign enemy may be able to reach into ordinary American life. A malicious cyberattack shut down computerized controls for the city's well and treatment plant, leaving the community dependent on water already stored in its tower.
Minnesota IT Services said state officials had yet to identify who was behind the attacks that took place Sunday and Monday. There were no reports that residents had been impacted by the attacks, though one city asked residents to conserve water for a couple hours while they tried to determine what was wrong.
The FBI, which is investigating, has not publicly identified a culprit and a spokesperson declined to say Thursday who the bureau thought might be responsible. The FBI, Cybersecurity and Infrastructure Security Agency and other agencies warned in an advisory last week that Iranian hackers have been targeting water and wastewater systems and the operational controls other critical infrastructure sectors.
Digital warfare has become ingrained in military conflict, and local water plants or healthcare facilities often lack the funds and know-how to install the latest software patches or take other security steps. That has made them a favorite target, both because of the relative ease of penetrating them and because of the panic such disruptions can cause.
Iran has the “geopolitical motivations” and a recent history of targeting water systems, said Cynthia Kaiser, the former deputy assistant director of the FBI’s cyber division who has been closely monitoring threats to critical infrastructure from hackers linked to the country.
Crews restored operations within hours, and officials found no danger to water quality.
More than 30 Minnesota community water systems were targeted on July 26 and 27. Plymouth lost communications with parts of its water infrastructure, though workers kept water flowing.
Related for our VIP Members: Buttigieg Exposed Our Supply Chain Weakness. Hackers Can Exploit It.
The FBI is investigating related incidents reported by water and wastewater utilities in at least seven states. Some attacks outside Minnesota caused pressure loss, flooding, boil-water notices, and prolonged manual operation.
The attacks come amid an intensification of the war between the U.S. and Iran, with the two sides trading missile attacks, and ongoing threats from both sides for increased destruction.
Iranian-linked hacking activity targeting U.S. water facilities predates the war, but a range of groups have carried out a series of prominent cyberattacks on domestic U.S. organizations, including medical services company Stryker and the Los Angeles County Metropolitan Transportation Authority in March.
The White House referred questions about the Minnesota incidents to the FBI. The FBI did not immediately respond to a request for comment about alleged Iranian involvement in the incidents.
State and local officials have said the Minnesota attacks did not threaten water safety, but that in some cases certain systems were taken offline and had to be reset manually. Thursday's alert from the Cybersecurity and Infrastructure Security Agency warned that hackers have, in some cases, changed passwords to lock out operators and disconnect certain devices from the networks, resulting in "boil water notices and sustained manual operations."
Unidentified victims have reported to the FBI that "operational effects" of the attacks have, in certain places, included loss of pressure and flooding, according to the FBI's statement.
Investigators haven't publicly identified the culprit. Iranian-linked hackers remain the leading concern because the timing, access methods, and targeted equipment resemble a campaign federal agencies had already identified.
A federal advisory updated July 22 warned that Iranian-affiliated actors were targeting internet-connected programmable logic controllers used across American infrastructure.
Those controllers can operate pumps, valves, treatment equipment, and other physical machinery. An attacker who gains access may change passwords, lock out workers, stop equipment, or force employees to run a plant by hand.
Poisoning the water isn't required to frighten a town; shutting down a pump or dropping pressure can disrupt an entire community.
Minnesota IT Services Commissioner and State Chief Information Officer Jon Eichten now has a difficult job. His agency must help local systems close the openings while preserving evidence for federal investigators.
Gov. Tim Walz's administration also needs to explain how many public systems remain exposed online and what resources smaller communities need to secure them.
The weakness reaches far beyond Minnesota. Federal inspectors found that more than 70% of water systems examined beginning in September 2023 violated basic federal risk and emergency-planning requirements.
Inspectors found default passwords, shared employee logins, incomplete plans, and access that remained active after workers had left their jobs.
President Donald Trump's administration should treat the Minnesota attacks as a national-security warning before investigators settle attribution. Federal agencies already recommend removing control systems from the public internet, changing default passwords, conducting regular assessments, backing up systems, and preparing manual recovery plans.
Local utilities need money and technical help, but continued exposure after repeated warnings can't be excused as bad luck.
Iranian-affiliated hackers have targeted American water facilities before. Federal agencies warned in 2023 that hackers tied to Iran's Islamic Revolutionary Guard Corps were exploiting exposed industrial controllers at water and wastewater plants.
Minnesota may be the latest test of how far such attackers can reach and how quickly local defenses react.
Americans expect clean water when they turn on a faucet. Braham's residents nearly lost the machinery that keeps the water moving. No one was harmed, and no contamination was found. The next attacker may be more skilled, more patient, or less restrained.
Investigators may need time to name the culprit; America can't wait to secure the systems.
Foreign enemies search for weak points while political leaders argue over yesterday’s battles. PJ Media VIP follows the threats others overlook and demands accountability before warnings become disasters. Join today and save 60% with promo code FIGHT.
Join the conversation as a VIP Member