Michigan and Minnesota Water Systems Hit by Cyberattacks

Michigan has reported cyberattacks on nine of its water systems, days after Minnesota reported similar breaches across the state.

The United States Federal Bureau of Investigation (FBI) said it was investigating both of the attacks on Saturday. In an advisory earlier this week, it said that at least seven states have reported incidents, but so far only Minnesota and Michigan have been identified.

No culprit has yet been pinpointed. However, the breaches came after the FBI, Cybersecurity and Infrastructure Security Agency (CISA) and other agencies warned in an advisory last week that Iranian hackers have been targeting water and wastewater systems and the operational controls of other critical infrastructure sectors.

“The FBI is aware of recent public reporting around Water and Wastewater (WWS) sectors,” the agency said in a statement on Saturday. “The FBI and our interagency partners are fully engaged to protect critical infrastructure, and we remain well-equipped to protect against cyber threats of all varieties.”

Dale George, the director of communications for Michigan’s Department of Environment, Great Lakes and Energy, meanwhile, said that “all systems continued to operate safely” following the attacks.

He said Michigan received a federal cyber alert on Tuesday about attempts to tamper with operational technology in water systems.

Soon after, the state received “a small number of reports from Michigan communities indicating activity consistent with what federal agencies described”, said George.

Minnesota had earlier in the week reported attacks on 30 sites. Minnesota IT Services, the state information technology agency, said most of the confirmed attacks involved technology that water systems use to remotely monitor and control equipment.

The agency has said that impacted systems did not necessarily equate to water disruptions, noting that as of Thursday, there were no active requests for residents to modify their water usage. Some modifications had been requested earlier in the week.

Local water plants are generally more vulnerable than other infrastructure because they are more likely to have out-of-date cybersecurity. Federal law enforcement has previously indicted Iranian hackers for allegedly targeting water infrastructure.

Throughout the war, US President Donald Trump has repeatedly threatened to attack civilian infrastructure in Iran, including power and water desalination plants.

When asked about the Minnesota attacks on Friday, Trump instead pivoted to criticise the Democrat-led state government in Minnesota.

“I think Minnesota is behind it,” Trump said, without providing further evidence or clarification. “I don’t think there was an Iranian cyberattack.”

Minnesota Governor Tim Walz, meanwhile, indicated his belief that Iran was behind the attack. He further blamed Trump’s cuts to federal government employees for making the US more vulnerable to cyberattacks.

“Trump knows exactly who is responsible for this attack, and knows that other states were hit too,” Walz said.