U.S. Water Systems Targeted by Iranian-Linked Cyberattacks

In April 2026, the U.S. Environmental Protection Agency (EPA), Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (NSA) issued a joint advisory warning of an urgent cybersecurity threat from Iranian-affiliated groups targeting U.S. drinking water and wastewater systems. The advisory highlighted the exploitation and disruption of operational technology (OT) systems ^[1].

By July 2026, U.S. government agencies, including the FBI, NSA, Department of Energy, and CISA, reported that Iranian state-backed hackers were actively disrupting industrial control systems at American water and energy providers. These disruptions included interference with programmable logic controllers (PLCs) from companies such as Rockwell, Schneider Electric, and Siemens, creating unsafe conditions without operator alerts ^[2].

In June 2026, the hacker group Handala, linked to Iran, claimed responsibility for breaching the California Water Service (Cal Water). The group leaked approximately 5 GB of data and asserted that it could have disrupted the water supply but chose not to. However, Cal Water’s investigation found no evidence of compromise to its operational technology or water production and distribution systems ^[3].

In late July 2026, more than 30 community water systems across Minnesota were targeted in a coordinated cyberattack. The attack focused on operational technology, including pumps, wells, water towers, and wastewater lift stations. Officials reported no immediate threats to drinking water safety ^[4]. U.S. and state officials suspect Iranian hackers were behind the Minnesota attacks, although definitive confirmation has not been made, and the possibility of false-flag activity remains ^[5].

Iran has a history of targeting U.S. water infrastructure, including a 2016 cyberattack on a small dam near New York City ^[6].

What Is Known

U.S. federal agencies have identified an ongoing cybersecurity threat from Iranian-affiliated groups targeting water systems. The attacks have focused on disrupting industrial control systems, potentially creating unsafe conditions ^[1][2]. The hacker group Handala claimed to have breached Cal Water, though no operational technology systems were compromised ^[3]. More than 30 water systems in Minnesota were targeted in a coordinated cyberattack ^[4].

What Remains Unclear

Definitive attribution of the Minnesota cyberattacks to Iranian hackers has not been confirmed, and the potential for false-flag operations exists ^[5]. The extent of Handala’s actual access to Cal Water’s operational technology systems remains disputed, as Cal Water found no evidence of compromise ^[3].