Michigan has reported cyberattacks on nine of its municipal water systems, joining Minnesota where over 30 water systems were targeted earlier this week. Federal investigators are looking into the source of these breaches, which follow recent warnings about Iranian cyber threats targeting critical infrastructure.
State officials in Michigan confirmed the incidents after receiving a federal cyber alert on Tuesday regarding attempts to tamper with water system operational technology. Dale George, communications director for the Michigan Department of Environment, Great Lakes, and Energy, stated that the state received a small number of reports from Michigan communities indicating activity consistent with what federal agencies described. George confirmed that nine systems were affected but emphasized that all systems continued to operate safely, issues were addressed by local operators, and there are no known impacts that posed a public health concern.
The FBI is actively investigating the cyberattacks but has not publicly named a suspect. An FBI spokesperson declined to comment on potential perpetrators on Thursday. However, the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and other federal agencies issued a joint advisory last week warning that Iranian hackers have been actively targeting water and wastewater systems, along with operational controls in other critical infrastructure sectors. In a statement on Saturday, the FBI said it "is aware of recent public reporting around Water and Wastewater (WWS) sectors," adding, "The FBI and our interagency partners are fully engaged to protect critical infrastructure and we remain well-equipped to protect against cyber threats of all varieties." This is not the first time Iranian hackers have targeted U.S. water infrastructure; in 2016, the Justice Department indicted a group of Iranian hackers for a cyberattack on a small dam near New York City.
In Minnesota, state IT services reported that as of Thursday, there were no active requests for residents to alter their drinking water usage. According to the agency, most of the confirmed breaches involved operating technology used to remotely monitor and control equipment. They clarified that being impacted indicates confirmed malicious activity rather than actual water service disruption. However, some localized disruptions did occur. In Braham, a city of approximately 1,700 people located about 70 miles (113 kilometers) north of Minneapolis, residents were asked to minimize water use for several hours on Monday. Attackers had disabled the operating controls that shut down the well and water treatment plant, forcing the city to temporarily rely solely on water stored in its water tower. The outage did not affect water quality, and the plant was brought back online.
Meanwhile, in Plymouth, a city of around 80,000 residents outside of Minneapolis, officials announced on social media that water infrastructure communications had been successfully restored by Tuesday afternoon following a cyberattack. The attacks also sparked a political dispute. During a Cabinet meeting on Friday at the Camp David presidential retreat in Maryland, President Donald Trump claimed without evidence that the cyberattacks in Minnesota were the fault of the state itself and its Democratic Governor, Tim Walz. Walz quickly fired back on social media, stating that Trump "knows exactly who is responsible for this attack, and knows that other states were hit too."
