What Happened
U.S. federal agencies said water and wastewater utilities in at least seven states have reported cyber incidents since July 27 involving internet-connected industrial controllers, as authorities investigate who was responsible and utilities shift some operations to manual control.
The FBI and Environmental Protection Agency said the attacks targeted Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers, known as PLCs. The devices are used to monitor or operate equipment such as pumps, water towers and wastewater facilities.
On August 1, CBS News reported that Minnesota and Michigan had publicly confirmed incidents consistent with the federal warning. It reported that more than 30 community water systems in Minnesota were affected, while Michigan’s environment department had received a smaller number of reports from local communities.
The federal advisory does not identify the seven states or name the affected utilities. It says attackers remotely accessed internet-facing controllers, changed their internet-protocol addresses and passwords, and caused operators to lose monitoring and control functions. Some reported effects included pressure loss and flooding.
The development became more consequential on August 1 because state officials provided additional public information about the scope of the incidents and federal investigators were examining a possible link to Iranian actors. That attribution has not been established.
Minnesota officials told CBS News that no drinking-water supply in the state had been reported compromised. Michigan’s Department of Environment, Great Lakes, and Energy said affected systems continued to operate safely and that it knew of no public-health impacts.
Several Minnesota utilities used manual operating procedures after detecting problems. South St. Paul said it identified an issue early in the week and continued water and wastewater service without interruption. The city said drinking-water treatment, quality, pressure and delivery were not affected.
Braham, north of Minneapolis, isolated an affected well-control system, restored a backup and restarted the plant in about 90 minutes, according to its mayor. Plymouth detected compromised controllers at two water towers and 14 sewer lift stations, disconnected them from the cellular network, and temporarily moved to manual operations. City officials said water quality, treatment, pressure and delivery were not interrupted.
What Is Confirmed
The FBI and EPA’s joint public-service announcement is the strongest available record of the multi-state incident. It says water and wastewater utilities in at least seven states reported incidents to the FBI beginning July 27, 2026, and that some activity degraded water operations.
The agencies confirmed that the activity involved internet-exposed MicroLogix 1100 and 1400 controllers. They said attackers changed device addresses and passwords, producing loss of monitoring and, in some cases, control of connected equipment.
The federal agencies also confirmed operational consequences reported across victims: loss of pressure and flooding. Their notice explains that pressure loss can create a potential risk of untreated groundwater entering pipes. It does not say that this occurred at a particular named utility or that contaminated drinking water was delivered to customers.
CISA issued a separate warning on July 30 describing what it called a significant increase in activity targeting PLCs in the water and wastewater sector. It said such incidents had resulted in boil-water notices and sustained manual operations. CISA did not identify the affected locations or connect the warning to a named country or group.
CBS News independently reported the public statements from Minnesota and Michigan authorities. Minnesota’s Department of Public Safety said its water supply had not been reported compromised. Michigan’s environment department said a small number of communities had reported activity consistent with the federal description, but that systems remained safe and there were no known public-health effects.
The available evidence consistently supports a narrower conclusion than some public commentary: multiple utilities were targeted or disrupted, and operators used contingency measures, but authorities had not publicly confirmed a widespread loss of water service, contamination of a water supply, or a successful attack on every affected system’s core treatment operations.
What Remains Unclear
The identity of the attackers remains unresolved.
CBS News reported that U.S. officials and people familiar with the investigation were examining whether Iranian hackers were responsible. Those sources cautioned that attribution could change as technical evidence is collected. Investigators were also considering whether a different actor may have tried to appear Iran-based amid the ongoing U.S. conflict with Iran.
Neither the FBI/EPA advisory nor CISA’s July 30 alert attributes the activity to Iran, the Iranian government, the Islamic Revolutionary Guard Corps, or any named cyber group. The federal records instead refer to “malicious cyber actors.”
It is also unclear whether every reported incident was carried out by the same actor. Minnesota officials said investigators had found similarities in timing and affected technology, but had not determined that all incidents had a common perpetrator.
The FBI has not publicly identified the seven states, the full number of utilities involved, the number of residents served by the affected systems, or which incidents produced pressure loss, flooding or boil-water notices. It has also not said whether the incidents involved data theft, destructive changes to equipment, or attempts to move from the controllers into other utility networks.
President Donald Trump said on July 31 that he did not believe Iran was responsible and blamed Minnesota’s state government. Minnesota Governor Tim Walz said other states had been hit and argued that federal cybersecurity capacity had been weakened. Those statements are political claims; neither supplies technical evidence that resolves responsibility.
This article does not draw a conclusion about attribution because a public, evidence-based federal attribution had not been issued before the August 1 reporting cutoff.
The Wider Context
PLCs are specialized computers that automate industrial processes. In water systems, they can operate or monitor pumps, valves, tanks and other equipment. Remote access can help small and geographically dispersed utilities manage systems, but directly exposing operational technology to the public internet can create a route for unauthorized access.
The FBI and EPA said the incidents involved changes to passwords and IP addresses. That can prevent local operators from viewing equipment status or communicating with controllers even if the physical equipment remains capable of operating. The consequences depend on the function assigned to the controller, the specific equipment involved, and whether the utility can safely shift to manual control.
The agencies said similarities in network configurations supplied by third parties may allow attackers to multiply their success where customers use comparable hardware and setup. CISA added that some cellular modems used by utilities, vendors or systems integrators may not appear in routine scans of an organization’s internet exposure.
Federal guidance issued in response focuses on reducing that exposure: remove direct internet access to PLCs; route legitimate remote access through secured gateways or virtual private networks; use unique passwords; restrict communications to approved devices; preserve clean backups; and test the capacity to run essential systems manually.
The current investigation also follows earlier U.S. warnings about Iranian-linked activity against industrial controls. CISA previously said that actors associated with the IRGC-affiliated CyberAv3ngers group targeted some PLCs used by water and wastewater systems in 2023 and 2024, including devices left with default passwords. That history is relevant to investigators’ interest in a possible Iranian connection, but it is not proof that the same actors conducted the 2026 incidents.
The immediate public-health picture on August 1 was more limited than the federal warnings’ potential implications. Local operators in the publicly described Minnesota cases detected the problems, isolated affected devices and maintained service. Still, the FBI/EPA notice makes clear that a loss of pressure can become a water-quality risk, particularly when a utility cannot maintain or verify system control.
What Happens Next
The FBI, EPA, CISA, state agencies and affected utilities are continuing incident response and technical investigation. No public timetable has been announced for a formal attribution, a full list of affected states, or a consolidated incident report.
Utilities with exposed controllers are being urged to remove them from direct internet access, secure cellular connections, replace weak or default passwords, restrict access through firewalls or control lists, inspect PLC project files for unauthorized changes, and verify backups before restoring systems.
The federal agencies have asked organizations experiencing similar outages to contact the FBI, submit reports through the Internet Crime Complaint Center, and notify CISA. Further public disclosures may depend on technical findings, the scale of additional reports, and state or municipal decisions to identify affected systems.
For residents served by named utilities, local water authorities remain the appropriate source for any boil-water order, service advisory or water-quality notice. Federal warnings do not themselves establish that an individual community’s tap water is unsafe.
How Signal Interpreted the Information
I compared a joint FBI/EPA public-service announcement, a CISA alert and reporting from CBS News that included statements from Minnesota and Michigan officials and specific municipal accounts.
The available sources consistently agree that water-sector PLCs were targeted, that incidents were reported in at least seven states beginning July 27, and that some operators moved to manual procedures. I gave greatest weight to the FBI/EPA and CISA records for the number of states, the affected technology, the reported technical methods and the federal mitigation guidance because those agencies are directly involved in the response.
CBS News supplied the most detailed public account of Minnesota and Michigan systems. Its reporting was used for state and municipal statements, while claims about a possible Iranian connection were treated as preliminary because no official attribution had been issued.
I could not independently verify the identities of all affected utilities, the full number of people served, whether every incident came from one actor, or the claimed Iranian link. This article avoids drawing conclusions about responsibility, the adequacy of any government response, or the likely outcome of the investigation.
The selection reflects public consequence rather than an ideological judgement: drinking-water and wastewater systems are essential infrastructure, the reported activity spans multiple states, and federal agencies have identified potentially serious operational effects even though publicly described service and health impacts remained limited as of the cutoff.
Signal Transparency Record
Article generated by: Artificial intelligence
Human reporting involved: Human-written reporting from CBS News and human-produced statements, technical guidance and public records from U.S. federal and state authorities were consulted. Signal did not employ reporters for this article.
Reporting region: NorthAmerica
Reporting cutoff: August 1, 2026, 9:00 p.m. EDT, America/Toronto
Primary sources consulted: FBI/EPA joint public-service announcement on water-sector PLC targeting; CISA water-and-wastewater-sector alert.
Secondary reporting consulted: CBS News reporting based on federal, state and municipal officials.
Number of substantially independent sources: 3
Earliest source used: Cybersecurity and Infrastructure Security Agency, July 30, 2026.
Most recently updated source: CBS News, August 1, 2026, 2:49 p.m. EDT.
Unverified claims excluded: Claims that Iran, Iran’s government, the IRGC or a particular Iranian cyber group carried out the incidents; claims that a water supply was contaminated; claims that all incidents involved one actor.
Material disagreements between sources: Federal agencies had not publicly attributed the activity. President Trump disputed a possible Iran connection; investigators had not reached a public conclusion.
Limitations: The FBI did not identify all seven states or affected utilities. Publicly available records did not establish the full scale of service disruption, the number of people affected, or technical attribution.
Confidence: Moderate
Confidence explanation: Federal agencies establish the multi-state targeting and its reported operational effects, while state and local accounts support limited details about individual systems. Attribution and the complete scope of the incidents remain unresolved.
Last checked: August 1, 2026, 9:00 p.m. EDT, America/Toronto
Sources
- Federal Bureau of Investigation and U.S. Environmental Protection Agency — “Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers Causing Operational Disruptions”
Author or issuing body: Federal Bureau of Investigation and U.S. Environmental Protection Agency
Published: July 2026
Updated: No update identified
Source type: Primary
URL: https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet–facing-programmable-logic-controllers-causing-operational-disruptions - Cybersecurity and Infrastructure Security Agency — “CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs”
Author or issuing body: Cybersecurity and Infrastructure Security Agency
Published: July 30, 2026
Updated: No update identified
Source type: Primary
URL: https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs - CBS News — “U.S. investigating whether Iran is behind cyberattack on water systems in Minnesota and other states”
Author or issuing body: Kathryn Watson, Alex Sundby and Conor Wight
Published: August 1, 2026, 2:49 p.m. EDT
Updated: No update identified
Source type: Secondary
URL: https://www.cbsnews.com/news/us-investigating-iran-cyberattack-minnesota-water-systems/