Photo: Maj. Christopher Vasquez, USAF | Public domain | Wikimedia Commons
U.S. Links Multi-State Water Cyberattacks To Likely Iran Hackers As FBI Details Altered Operating Instructions
The FBI told reporters Thursday, Aug. 6, 2026, that hackers had altered operating instructions for water systems in some affected states, a move investigators say increased the intrusions' operational risk.[1]
U.S. officials now link the multi-state campaign to likely Iran-backed hackers, and at least a dozen states have reported intrusions or attempted intrusions so far.[2][3]
On July 30, 2026 the FBI, the Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency warned that threat actors had remotely accessed water and wastewater systems in at least seven states and urged operators to disconnect internet links and harden passwords and firewalls.[3] In Minnesota more than 30 community water systems were affected, and utilities in Michigan, New Jersey, South Dakota and Georgia also reported intrusions or attempts.[3] In Georgia, a July 27 intrusion at the Clayton County Water Authority caused a pressure drop for roughly 300,000 customers and a temporary boil-water advisory before service was restored.[3]
Investigators and outside experts say attackers exploited exposed programmable logic controllers that were often internet-connected or left with weak or no passwords.[4] Attackers changed PLC IP addresses to lock out operators, gained remote access to pumps and valves, and in some cases altered operating instructions, forcing utilities to switch to manual controls.[1] Officials say drinking water has not been contaminated so far, but they warn future attacks could cause dangerous pressure surges or cut service in ways that would harm hospitals and other critical facilities.[3]
Early coverage flagged investigators were probing Iranian involvement; President Trump publicly cast blame instead on Minnesota's governor at a July 31 Cabinet meeting, a claim the governor rejected.[5] As more forensic work and FBI briefings surfaced, reporting shifted from an initial inquiry to a firmer working assessment that Iran-backed actors are the likely culprits and that the intrusions included changes to how systems operate.[6]
Show source details & analysis (11 sources)
📌 Key Facts
- On July 30, 2026 the FBI, EPA and CISA warned that threat actors had remotely accessed water and wastewater systems in at least seven states, causing loss of monitoring and control and urging operators to disconnect internet connections and harden passwords and firewalls; FBI, EPA and CISA issued the advisory.
- U.S. and Minnesota state officials told investigators (reported July 31, 2026) they assess Iran is "likely responsible" for the hacking spree that hit dozens of Minnesota municipal water systems, while stressing that attribution is preliminary and that attackers could try to mimic Iran-based actors; this assessment was reported by U.S. and Minnesota state officials.
- The FBI said on July 30, 2026 that hackers targeted water facilities in at least seven states and that some systems were "degraded," and federal reporting later expanded the count to at least a dozen states by Aug. 5–6, 2026; the initial FBI statement noted impacts to operations and monitoring of utilities (at least seven states).
- In Minnesota alone more than 30 community water systems were impacted in late July 2026, and officials reported intrusions or attempted intrusions in other states including Michigan, Georgia, New Jersey and Rapid City, South Dakota — overall affecting at least a dozen U.S. states; more than 30 community water systems were impacted in Minnesota.
- Federal investigators and outside experts say attackers exploited exposed programmable logic controllers (PLCs) that were often internet-connected or lacked passwords, changed PLC IP addresses to lock out operators, gained remote access to pumps, valves and pressure controls, and in some cases [altered operating instructions] (https://www.cbsnews.com/video/fbi-hackers-altered-operating-instructions-for-water-systems/) for water systems.
- A July 27, 2026 intrusion at the Clayton County Water Authority in Georgia caused a water-pressure drop that affected roughly 300,000 customers and prompted a temporary boil-water advisory before service was restored within hours.
- Officials told reporters that drinking water has not been contaminated so far, but experts warn attackers could in the future cause dangerous pressure surges or cut service in ways that might disable hospitals; the reporting noted that drinking water has not been contaminated.
- On July 31, 2026 President Trump downplayed the incidents at a Camp David Cabinet meeting and blamed Minnesota Gov. Tim Walz rather than Iran; Gov. Walz publicly rejected the accusation — a sequence captured in a President Trump segment.
- On Aug. 2, 2026 Rep. Mike Turner said critical infrastructure must be "hardened," that Congress had not yet been formally briefed on the water-system cyber activity, and warned U.S. adversaries view civilian systems like water utilities as valid military targets; these comments were reported from Rep. Mike Turner.
📰 Source Timeline (11)
Follow how coverage of this story developed over time
August 06, 2026
10:37 PM
FBI says hackers altered operating instructions for water systems in some states
New information:
- On Thursday, August 6, 2026, the FBI told CBS News that hackers altered operating instructions for water systems in some of the affected states.
- The same FBI update said at least 12 U.S. states are now reporting cyberattacks on water systems that may be linked to Iran-backed hackers, refining earlier counts of impacted states.
- CBS homeland security correspondent Nicole Sganga characterized these changes to operating instructions as part of the latest FBI understanding of the intrusions.
9:48 PM
America's water systems are getting hacked amid security gaps, experts say
New information:
- Article reiterates that cyberattacks have hit water systems in at least a dozen U.S. states and notes there is no federal requirement for utilities to report hacks, meaning the true scope may be larger.
- Details that attackers are exploiting exposed programmable logic controllers (PLCs) used to control water pressure and chemical treatment, with many PLCs directly connected to the internet and in some cases lacking passwords or protected only by easily guessed ones.
- Cites a July 30, 2026 CISA notice warning that PLCs are often internet-connected, allowing remote access, and an FBI July 30 statement that some targeted utilities suffered pressure loss and flooding.
- Provides specific state-level examples of recent incidents, including a July 27, 2026 attack on the Clayton County Water Authority in Georgia that serves 300,000 customers and triggered a temporary boil-water advisory after a drop in water pressure.
- Reports that in Minnesota more than 30 community water systems were affected in late July 2026, and that utilities in Michigan, New Jersey and Rapid City, South Dakota also experienced attempted or successful intrusions.
- Describes attackers changing PLC IP addresses to lock out operators and force utilities to switch to manual control after losing remote access to pumps, valves and water-pressure management.
- Quotes expert Joshua Corman saying many systems were "directly on the internet with no firewalls or VPNs" and often with no passwords set, calling water systems "low-hanging fruit" for malicious actors.
- Notes that while drinking water has not been contaminated and utilities have quickly regained control so far, experts warn attackers could in future cause dangerous pressure surges that might disable hospitals within hours by cutting water service.
2:02 PM
Cyberattacks possibly linked to Iran threatened water systems in a dozen states, sources say
New information:
- CBS News reported in an August 6, 2026 TV segment that cyberattacks 'possibly linked to Iran' have threatened water systems in at least a dozen U.S. states, reiterating that U.S. officials suspect Iran-backed hackers are behind the intrusions.
- The segment underscores that these attacks specifically 'threatened' water systems, reinforcing that the intrusions went beyond mere scanning activity and posed operational risks to utilities.
August 05, 2026
10:27 PM
At least 12 states report cyberattacks on water systems possibly linked to Iran
New information:
- As of Wednesday, August 5, 2026, CBS sources say cyberattacks on U.S. water systems have been reported in at least a dozen states, expanding beyond the previously reported seven.
- States now specifically listed as affected include Michigan, Minnesota, Georgia, New Jersey and South Dakota.
- In Minnesota alone, more than 30 community water systems were impacted by the cyber activity.
- In Georgia, cyber activity at the Clayton County Water Authority last month caused a water-pressure drop for its roughly 300,000 customers in the Atlanta area and forced a temporary boil-water advisory before service was restored within hours.
- Some affected utilities lost critical remote-control capabilities for their systems and had to shift to manual operation, while hackers in several cases gained remote access to pumps, valves and water pressure.
- Officials told CBS that, so far, drinking water remains safe and there has been no contamination impact on water quality.
- The article reiterates that on July 30, 2026, the FBI, EPA and CISA jointly warned water and wastewater systems that threat actors had remotely accessed systems in at least seven states, causing loss of monitoring and control functionality, and advised operators to disconnect from the internet and harden passwords and firewalls.
- Federal investigators continue to suspect Iran-backed hackers, with tactics resembling a 2023 CyberAv3ngers campaign tied to Iran’s Revolutionary Guard that exploited default passwords on water-system controllers, but no formal attribution has yet been made.
August 03, 2026
10:35 PM
What we know about the cyberattacks on water systems in 7 states
New information:
- On Monday, August 3, 2026, PBS reported that federal officials now reportedly believe Iran is the likely culprit behind the cyberattacks on water systems in at least seven states.
- The PBS NewsHour segment reiterates the FBI’s confirmation that at least seven states have been targeted in the wave of cyberattacks on critical water infrastructure.
- The program features new on-the-record analysis from former FBI cyber-division deputy assistant director Cynthia Kaiser, offering detailed context on likely tactics, motives and defensive needs, though not new operational facts.
August 02, 2026
4:23 PM
Rep. Turner says infrastructure should be "hardened" as U.S. probes water cyberattack
New information:
- On Sunday, August 2, 2026, Rep. Mike Turner said on CBS' 'Face the Nation' that critical infrastructure assets 'need to be hardened' in response to the recent cyber incidents at water systems.
- Turner stated that Congress has not yet been formally briefed on last week's cyber activity affecting water systems in Minnesota and at least six other states.
- Turner publicly emphasized that U.S. adversaries including Russia, China, North Korea and Iran view civilian critical infrastructure such as water systems as 'valid military targets'.
- The article reiterates that some affected utilities were forced to switch to manual operations after the cyber activity, based on prior FBI statements last week.
- Turner noted that Iranian state-sponsored hackers have previously attacked U.S. critical infrastructure, framing the current probe in the context of a long-running pattern.
July 31, 2026
11:43 PM
Trump blames Minnesota cyber attacks on its governor, not Iran
New information:
- At a Cabinet meeting at Camp David on Friday, July 31, 2026, President Trump publicly downplayed the Minnesota water-system cyberattacks and blamed Minnesota Gov. Tim Walz rather than Iran.
- Trump's remarks contrasted with U.S. officials' earlier statements that Iran was likely responsible for the attacks, though attribution remained preliminary.
- The comments were made during a Cabinet session that the president held at Camp David and were reported in a CBS News segment aired at 6:43 p.m. Central on July 31, 2026.
7:48 PM
Trump Blames Minnesota, Not Iran, for Cyberattack, Despite Initial Investigation
New information:
- On Friday, July 31, 2026, President Trump told a cabinet meeting he does not believe Iran was behind the water-system cyber incidents and instead claimed, without evidence, 'I think Minnesota is behind it. I think the governor’s behind it.'
- The New York Times reports that U.S. and Minnesota state officials currently assess Iran is 'likely responsible' for the hacking spree affecting dozens of Minnesota municipal water systems, while stressing the attribution is still preliminary.
- The FBI said late Thursday, July 30, 2026, that hackers targeted water facilities in at least seven U.S. states and that some systems were 'degraded' by the attack.
- Gov. Tim Walz publicly rejected Trump’s accusation on social media on July 31, saying Trump 'knows exactly who is responsible for this attack, and knows that other states were hit too' and calling it an example of modern warfare.
- Federal and state officials told the Times on July 31 that no new evidence has emerged to undercut the working assessment pointing to Iran, though they cautioned that hackers could theoretically be posing as Iran-based actors.
3:13 PM
U.S. investigates potential Iran link to water system cyberattacks
New information:
- The July 31, 2026 CBS News TV segment reiterates that U.S. investigators are examining whether Iran was involved in cyberattacks on more than 30 community water systems in Minnesota and other states.
- The segment frames the ongoing inquiry as looking at a 'series of cyberattacks on water systems in Minnesota and other states,' underscoring that the suspected activity extends beyond Minnesota.
- The report confirms that the Iran-attribution question remains under active investigation and has not yet been resolved.
12:12 PM
U.S. investigating whether Iran hacked dozens of water systems
New information:
- CBS reports on July 31, 2026 that U.S. officials are investigating whether Iran was behind hacking of more than 30 community water systems across Minnesota.
- The TV segment reiterates that CBS News has learned of the probe into Iranian involvement, reinforcing earlier print reporting on the same incident.