Cyberattack targets more than 30 Minnesota water systems

A "coordinated cyberattack" targeted more than 30 community water systems in Minnesota on July 26 and July 27, according to the state's information technology agency.

Minnesota IT Services said it was not aware of any active requests from Minnesota cities asking residents to change their drinking water usage. The statement came a day after local media reported that four Minnesota cities had issued notices about cyberattacks affecting their networks.

The incidents are similar to a series of cyber intrusions targeting U.S. water infrastructure that officials have previously linked to Iranian-affiliated hackers. The attacks have raised concerns over the vulnerability of local utilities that provide essential services to millions of people.

Emily Zimmer, a spokesperson for Minnesota IT Services, told Reuters in an email that the investigation was ongoing. She said the "timing, methods of access, and targeted infrastructure share characteristics with other coordinated cyber incidents our federal partners have observed involving critical infrastructure."

Zimmer said the agency could not yet confirm responsibility for the attacks or provide further details about the incidents. She added that investigators used the term "attack" because they identified unauthorized access carried out with malicious intent against the affected systems.

The Federal Bureau of Investigation (FBI) said it was aware of the incident and was working with affected organizations to address the matter. The Cybersecurity and Infrastructure Security Agency (CISA) did not immediately respond to a request for comment.

Although authorities have not determined who was behind the attacks, Iranian-linked hackers have targeted U.S. water systems for years, with varying degrees of success.

A CISA advisory issued on April 7 warned that Iranian-affiliated hackers were targeting internet-connected programmable logic controllers, which are computer devices used to operate machinery and support critical infrastructure systems. The advisory initially focused on devices manufactured by Rockwell Automation.

An update issued on July 22 expanded the warning to include devices made by Schneider Electric, Siemens, and potentially other manufacturers.

Joe Slowik, director of threat research and cyber engineering at cybersecurity firm Dataminr, said the expanded targeting showed a growing concern over Iran-linked cyber activity against U.S. critical infrastructure.

"Extending this activity to encompass additional equipment lines and pairing this with process manipulation and safety degradation makes matters more concerning as it enables various physical impact scenarios," Slowik said in a July 27 blog post published on the company's website.

The investigation into the Minnesota cyberattacks remains ongoing as federal and state authorities continue to assess the scope and impact of the incidents. -Reporting by AJ Vicens in Detroit, with additional reporting by Raphael Satter in Washington; Editing by Sanjeev Miglani/Reuters