Georgia and Michigan confirm water system hacking incidents

FBI probes multi-state campaign

Georgia and Michigan have become the latest US states to report cyberattacks targeting water systems, as federal authorities investigate a wave of intrusions affecting utilities across at least seven states.

Officials in both states said they had identified activity matching attacks first disclosed in Minnesota last week, although neither reported significant operational disruption or any risk to drinking water supplies.

Michigan's Department of Environment, Great Lakes, and Energy said nine water systems had reported hostile cyber activity.

Communications director Dale George said the department had received a small number of reports consistent with the incidents first identified in Minnesota.

He said all affected systems continued to operate safely, with no known impacts posing a risk to public health.

Georgia also confirmed that water facilities in the state had experienced similar activity, but said the impact had been limited.

Neither state has issued a public-facing alert about the incidents.

The FBI said water and wastewater utilities in at least seven states had reported attacks since 27 July, with some incidents disrupting normal operations.

Federal warning over industrial controllers

In a security advisory issued last week, the FBI said attackers had so far focused on internet-connected programmable logic controllers (PLCs) manufactured by Rockwell Automation under its Allen-Bradley brand.

Investigators said the hackers remotely accessed exposed industrial devices before changing IP addresses and passwords, causing operators to lose monitoring and control capabilities.

At least one utility also discovered that PLC project files had been altered after engineers identified unexpected changes in ladder logic programming.

The bureau warned that organisations using other manufacturers' industrial controllers should also strengthen their defences, noting that shared network configurations provided by third-party suppliers could allow attackers to compromise multiple customers using similar setups.

According to the FBI, some affected utilities experienced reduced water pressure and flooding. A loss of pressure can create conditions in which untreated groundwater could enter distribution pipes.

Separately, the Cybersecurity and Infrastructure Security Agency (CISA) updated guidance in July warning that industrial controllers made by Siemens, Schneider Electric and potentially other vendors were also being targeted by hackers linked to Iran.

Dispute over responsibility

Although the FBI has not officially attributed the campaign to any group or country, several cybersecurity researchers believe Iranian state-linked hackers are the most likely perpetrators.

Security firm Tenable said the activity closely resembles previous operations conducted by the IRGC-linked CyberAv3ngers group.

A report by Wired said a restricted alert circulated through WaterISAC suggested the Minnesota activity matched an earlier Iran-affiliated campaign. WaterISAC later said it had not made any formal attribution and denied providing the leaked document to the publication.

Researchers at cybersecurity company Claroty have suggested another Iranian-linked group, Handala, could instead be responsible.

"We're not sure yet if it's CyberAv3ngers or Handala," researcher Yhonatan Harari told Wired.

"But in a very high likelihood we can say it's Iranian actors."

President Donald Trump dismissed suggestions that Iran was behind the attacks, instead, without evidence, blaming Minnesota Governor Tim Walz.

Walz, however, maintained that the incidents were part of a broader Iranian cyber campaign.

He also argued that cuts to the Cybersecurity and Infrastructure Security Agency (CISA) under the Department of Government Efficiency (DOGE) had left US critical infrastructure more vulnerable to cyber threats.

"Thankfully, our experts in Minnesota were able to identify the vulnerability quickly and work with local communities to stop it," he said.