Cyberattack targets 30+ water systems in Minnesota: What the state knows so far
Iran possibly linked to MN water system cyberattacks
U.S. officials suspect Iran-affiliated hackers may be responsible for the cyberattack this week that impacted more than 30 community water systems in Minnesota, according to a New York Times report. FOX 9's Mike Manzoni has the story.
(FOX 9) - Minnesota officials are responding to a wave of cyber threats against community water systems, focusing on recovery and preventing further risks.
Statewide response prioritizes recovery and security
What we know:
According to Minnesota IT Services, state, local and federal agencies are working together after discovering malicious cyber activity at more than 30 water systems earlier this week. Most cases involved technology that lets operators remotely monitor and control equipment, including programmable logic controllers and human-machine interfaces.
Officials say "impacted" means investigators found evidence of malicious activity, but it does not mean every affected community lost water service. Minnesota’s response centers on protecting public services, helping local operators and minimizing further impacts.
State agencies are directly assisting the impacted water systems to contain the threat, assess potential impacts and restore normal operations. At this time, there are no active requests for residents to change their drinking water use.
The backstory:
Minnesota activated its coordinated cyber response capabilities immediately after learning about the cyber activity. The state has established partnerships and cybersecurity capabilities to help state and local governments prepare for, respond to and recover from these kinds of incidents.
Investigators have found similarities in timing and technology among the incidents, but have not determined that every case is connected to the same source. The state is not releasing system-specific forensic details while the investigation is active, to avoid creating additional risks.
Officials are continuing to assess whether any equipment issues or service disruptions are directly linked to the cyber activity. Local water-system operators are responsible for decisions about taking equipment offline or requesting water conservation.
Guidance for water systems
Dig deeper:
Officials urge water and wastewater systems to take immediate steps to secure their operational technology. Recommendations include removing unnecessary internet access, replacing default credentials with strong passwords, enabling multi-factor authentication, reviewing remote-access logs, separating operational technology from business networks, keeping accurate inventories and maintaining offline backups.
Officials also advise systems to report any suspected cyber activity to state and federal officials right away.
Minnesota IT Services is coordinating response efforts with the Minnesota Department of Public Safety, Bureau of Criminal Apprehension’s Minnesota Fusion Center, Minnesota Department of Health, Minnesota Pollution Control Agency, Cybersecurity and Infrastructure Security Agency, U.S. Environmental Protection Agency, Federal Bureau of Investigation (FBI) and local water utilities.
The FBI says they have gotten reports from at least seven states that water utility companies had attacks, which degraded water operations.
FBI officials state that the cyberattacks targeted Operation Technology, including Automation/Allen-Bradley Programmable Logic Controllers (PLCs), specifically MicroLogix 1100 and 1400 series.
Sen. Klobuchar briefed by US National Cyber Director
What they're saying:
U.S. Sen. Amy Klobuchar shared the following statement on Friday regarding the attack:
"Today I spoke with U.S. National Cyber Director and Minnesota native Sean Cairncross about the recent cyberattacks impacting Minnesota municipal water facilities. Director Cairncross confirmed that at this point there are no effects on services.
"I have also talked to several mayors whose communities have been impacted by the attacks. I want to thank federal, state, and local law enforcement, including the FBI, for their work on the investigation of the cyberattacks against Minnesota’s water infrastructure.
"While the investigation is still ongoing, the FBI and EPA are warning utilities that hackers are trying to disrupt critical water infrastructure, and that the hackers targeted specific brands of control systems used by municipal water utilities.
"Director Cairncross and I discussed updated technology, recognizing that resources are an issue for so many communities, not just in Minnesota but across the country.
"I will continue to advocate for strong federal, state, and local coordination to immediately investigate and stop cyberattacks as well as for updated technology to secure our critical infrastructure from cyber threats."
Officials have not attributed the activity to a specific actor and the investigation is ongoing.
Report: Iran behind Minnesota cyberattack?
The other side:
The New York Times reported Thursday morning that U.S. officials suspect that Iran-linked hackers may be responsible for the attack. The Times report states that this is a preliminary assessment and officials have not yet determined for certain who is responsible for the cyberattacks.
Officials said it was possible the attacks may have been committed by someone posing as Iranian hackers in an attempt to increase tensions between the two nations – but experts told the New York Times that scenario was unlikely.
Trump blames Minnesota:
However, President Donald Trump blamed Minnesota, not Iran, for the cyberattack, and failed to acknowledge the other states impacted.
"We heard in Minnesota there was a cyberattack, and they blame it on Iran. I don't think so. I think I blame it on Minnesota because they're grossly incompetent," Trump said during a Cabinet meeting on Friday.
Trump also criticized Gov. Tim Walz, saying, "I would blame it on Minnesota and the governor, the corrupt governor of Minnesota. They like to say, 'Oh, is Iran?' Iran should be so lucky. Iran's got bigger problems than worrying about Minnesota."
Gov. Walz responds:
Gov. Walz responded to the president's saying Trump "knows exactly who is responsible for this attack," noting that the cyberattack affected multiple states, not just Minnesota.
"This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran," said Walz.
Walz also argued that cuts made by the Trump administration's Department of Government Efficiency left the U.S. "exposed" to cyberattacks, adding, "Thankfully, our experts in Minnesota were able to identify the vulnerability quickly and work with local communities to stop it."
The Source: A press release from Minnesota IT Services, the FBI and past FOX 9 reporting.