Cyberattacks on US water systems spread to Georgia, Michigan
Iran-linked hackers target critical infrastructure amid rising geopolitical tensions.
1Expanding attack footprint
Georgia and Michigan became the latest US states to report cyberattacks targeting water systems, with the FBI investigating similar incidents across at least seven states. While Iran-backed hackers are prime suspects, no official attribution has been made. Activities matching the attack pattern detected last week at over 30 Minnesota facilities were reported. No operational disruptions have been confirmed in any state.
2Michigan's situation
Nine water systems in Michigan reported cyber intrusions to the state's Department of Environment, Great Lakes, and Energy. Spokesperson Dale George confirmed receiving 'a small number' of reports consistent with Minnesota's incidents but noted no public health consequences. All systems continued safe operations, with issues resolved by local operators. No public warnings were issued by state authorities.
3Georgia's confirmation
Georgia officials confirmed to ABC News they were affected but described the damage as limited. Like Minnesota, no public notifications were released. According to an FBI advisory last week, intrusions have impacted at least seven states. The bureau didn't name perpetrators or mention Iran specifically in its statements about the ongoing investigation.
4Technical attack vectors
The FBI has so far only observed activity targeting Rockwell Automation/Allen-Bradley PLCs but urged organizations using other manufacturers' devices to implement identical security hardening. A July 22 CISA advisory update warned that Schneider Electric, Siemens, and potentially other PLC brands are also being targeted by Iran-affiliated threat actors exploiting similar vulnerabilities.
5Iran connection theories
Tenable researchers were among the first to publicly suggest Iranian involvement, citing similarities with past attacks by IRGC-linked CyberAv3ngers. Minnesota—first to confirm attacks occurring July 26-27—reported over 30 community water systems targeted but made no official attribution. A leaked WaterISAC document allegedly described Minnesota activity as aligning with earlier Iran-affiliated campaigns, though WaterISAC denied providing the document to media.
6Political fallout
President Trump dismissed Iran links without evidence, blaming Minnesota's 'gross incompetence' and suggesting the governor's involvement during Friday's cabinet meeting. Minnesota Governor Tim Walz countered that Iran was clearly responsible and highlighted how Trump's funding cuts to CISA left critical infrastructure vulnerable. 'This is modern warfare,' Walz stated, criticizing the administration's lack of cyber defense strategy against Iran.
7Infrastructure security debate
Governor Walz emphasized that Trump-era budget cuts to CISA weakened national cyber defenses, leaving water facilities exposed. 'DOGE took an axe to CISA and left the US exposed,' he remarked, praising Minnesota experts for quickly identifying and mitigating vulnerabilities. The incident has reignited debates about protecting critical infrastructure and adequate funding for federal cybersecurity agencies amid growing threats.
8National security implications
The multi-state coordinated attacks exposed vulnerabilities in US critical infrastructure cybersecurity. Experts warn that water systems' security is a national security imperative, with the incidents demonstrating how geopolitical tensions can translate into asymmetric cyber threats. The attacks have intensified discussions about norms for state-sponsored cyber operations targeting civilian infrastructure and the need for international agreements to prevent escalation.