Cyberattacks targeting water systems in two US states have prompted the Federal Bureau of Investigation (FBI) to act. The FBI launched an investigation after attacks on nine water facilities in Michigan and 30 in Minnesota.
In a statement on Saturday, the FBI said similar incidents had been reported in at least seven states, but so far only the cases in these two states have become public. The perpetrator has not yet been identified.
Attacks follow Iran warning
The attacks came just after a warning issued last week by the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) that Iranian hackers could target water and wastewater systems.
In a written statement, the FBI said, "The FBI is aware of recent public reporting regarding the Water and Wastewater sectors. We are fully engaged with our interagency partners to protect critical infrastructure and are equipped to counter any cyber threat."
Dale George, communications director for the Michigan Department of Environment, Great Lakes, and Energy, said all systems continued to operate safely after the attacks. George said the state received a federal cyber alert on Tuesday about attempts to interfere with operational technology in water systems, and soon after received reports of activity matching the description provided by federal officials.
Trump and Governor Walz trade accusations
Asked about the attacks in Minnesota, former President Donald Trump responded without providing any evidence, "I think Minnesota is behind it." Trump said, "I don't think it was an Iranian cyberattack."
Minnesota Governor Tim Walz, however, said he believes Iran is behind the attack. Walz also argued that Trump's cuts to federal government employees have made the US more vulnerable to cyberattacks. "Trump knows very well who is responsible for this attack and is aware that other states have also been hit," he said.
Infrastructure vulnerabilities
Minnesota IT Services said most of the confirmed attacks targeted remote monitoring and control equipment of water systems. The affected systems did not cause water outages, and as of Thursday there was no active request for the public to change water usage. Earlier in the week, some areas experienced brief restrictions.
Local water facilities are considered more vulnerable than other critical infrastructure because their cybersecurity systems are often outdated. Federal law enforcement had previously indicted Iranian hackers for allegedly targeting water infrastructure. Throughout the war, Trump repeatedly threatened to strike civilian infrastructure in Iran, including electricity and water treatment plants.
