Iranian hackers suspected in attack on 30 US water systems

Key points

• Around 30 water systems across Minnesota were attacked on Sunday 27 and Monday 28 July 2026.
• The town of Braham lost running water for roughly two hours before service was restored.
• Cybersecurity firm Tenable says the attack methods are consistent with CyberAv3ngers, a group the US government links to the Iranian government.
• The US Cybersecurity and Infrastructure Security Agency issued a warning about Iranian attacks on US infrastructure on 22 July, days before the incident.
• US authorities suspect Iranian involvement but have not formally assigned blame.

Sometime on Sunday evening, water service in Braham, a small town north of Minneapolis, Minnesota, simply stopped. It came back after about two hours. What happened in between is now the subject of a federal investigation.

Around 30 municipal water systems across Minnesota were hit with cyberattacks that weekend, according to reports citing a security firm and US investigators. The targets were the computerised control systems, known as operational technology or OT, that modern water utilities use to manage pumps, valves, and chemical dosing. When those systems are disrupted, operators lose the ability to monitor and adjust the water supply.

Who did this?

No government has formally named a culprit yet, but two threads point in the same direction. Cybersecurity firm Tenable analysed the methods used and said they are "consistent with" a group tracked as CyberAv3ngers. The US government accuses CyberAv3ngers of operating under the direct control of Iran's Islamic Revolutionary Guard Corps. FBI Assistant Director Brett Leatherman, who leads the bureau's Cyber Division, said publicly that "Iranian cyber actors continue to target US critical infrastructure."

That is not a formal attribution. Investigators have not yet ruled out the possibility that another group copied CyberAv3ngers' methods. Medium confidence, in the language of threat intelligence, is where this sits right now.

The timing is notable. On 22 July, the US Cybersecurity and Infrastructure Security Agency (CISA, the federal body responsible for protecting critical infrastructure) published an advisory warning that Iranian-linked groups were actively targeting the computerised control systems that run US power grids, water plants, and other essential services. The Minnesota attacks followed within the week.

Why would Iran target drinking water?

Context matters here. In February 2026, the United States and Israel launched military operations against Iran. A US military investigation, reported by ABC News Australia, found that an airstrike on 28 February killed more than 150 people at an elementary school in Minab, southern Iran, apparently because incorrect coordinates were used while targeting a nearby military base.

Iran-linked groups have framed subsequent attacks as retaliation. In March, a group called Handala Hack claimed it broke into medical equipment company Stryker (which confirmed the incident) and digital payments firm Verifone (which denied it). The pattern fits what analysts call hack-and-leak or disruptive retaliation: attacks chosen for their visibility and public impact rather than espionage value.

CyberAv3ngers has previously targeted the same category of water-plant control hardware, so returning to that playbook carries symbolic weight alongside any operational disruption.

Should residents be worried about their tap water?

Braham's supply was restored within two hours, and officials have not reported any contamination. There is no indication the attackers changed any chemical settings or caused lasting damage to pipes or treatment equipment.

That said, if you live in Minnesota and your water pressure dropped or service was interrupted this week, it is worth checking with your local utility for any official updates. Standard advice applies: if a utility issues a boil-water notice, follow it until it is lifted.