Iranian hackers suspected in attack on 30 US water systems

Key points

• Around 30 water systems across Minnesota were attacked on Sunday 27 and Monday 28 July 2026.
• The town of Braham lost running water for roughly two hours before service was restored.
• Cybersecurity firm Tenable says the attack methods are consistent with CyberAv3ngers, a group the US government links to the Iranian government.
• The US Cybersecurity and Infrastructure Security Agency issued a warning about Iranian attacks on US infrastructure on 22 July, days before the incident.
• US authorities suspect Iranian involvement but have not formally assigned blame.

Sometime Sunday evening, water service in Braham, a small town north of Minneapolis, simply stopped. It came back after about two hours. What happened in between is now a federal investigation.

Around 30 municipal water systems across Minnesota were hit that weekend, according to reports citing a security firm and US investigators. The targets were computerised control systems, known as operational technology or OT, that water utilities use to manage pumps and chemical dosing. When those systems are disrupted, operators lose the ability to monitor and adjust the water supply. We first reported the attack on 29 July, when it emerged that one city had shut its plant down entirely.

Who did this?

No government has formally named a culprit, but two threads point the same way. Cybersecurity firm Tenable analysed the methods used and said they're "consistent with" a group tracked as CyberAv3ngers, which the US government accuses of operating under Tehran's direct control. FBI Assistant Director Brett Leatherman, who leads the bureau's Cyber Division, said publicly that "Iranian cyber actors continue to target US critical infrastructure."

That's not a formal attribution. Investigators haven't ruled out another group copying CyberAv3ngers' methods. Medium confidence is where this sits right now.

The timing matters. On 22 July, the US Cybersecurity and Infrastructure Security Agency (CISA, the federal body responsible for protecting critical infrastructure) published an advisory warning that Iranian-linked groups were actively targeting the control systems running US water plants and other essential services. We'd covered CISA's earlier advisory naming specific vulnerable hardware on 23 July. The Minnesota attacks followed within the week.

Why would Iran target drinking water?

Context matters. In February 2026, the United States and Israel launched military operations against Iran. A US military investigation, reported by ABC News Australia, found that an airstrike on 28 February killed more than 150 people at an elementary school in Minab, southern Iran, apparently because incorrect coordinates were used while targeting a nearby military base.

Iran-linked groups have framed attacks since then as retaliation. In March, a group called Handala Hack claimed it broke into medical equipment company Stryker (which confirmed the incident) and digital payments firm Verifone (which denied it). The pattern fits what analysts call disruptive retaliation: attacks chosen for visibility and public impact rather than espionage value. CyberAv3ngers has previously gone after the same category of water-plant control hardware, so returning to that playbook carries symbolic weight alongside any operational disruption.

Should residents be worried about their tap water?

Braham's supply was restored within two hours, and officials haven't reported any contamination. There's no indication the attackers changed chemical settings or caused lasting damage to pipes or treatment equipment. If you live in Minnesota and your water pressure dropped this week, check with your local utility. If a utility issues a boil-water notice, follow it until it's lifted.