Hackers linked to Iran attack water infrastructure in a dozen states

The vulnerability of U.S. critical infrastructure has been laid bare. Sources familiar with an ongoing federal investigation told CBS News that water treatment and supply plants in at least a dozen states have been targeted by cyberattacks.

Preliminary findings by official investigators point to hacker groups backed by the Iranian regime.

Among the entities affected by this wave of intrusions are Michigan, Minnesota, Georgia, New Jersey and South Dakota. The extent of the sabotage has varied by region, but authorities have sounded the alarm due to the sophistication and systematic nature of the intrusions into internal control systems.

Loss of digital control and manual emergency operations

The cyberattacks succeeded in compromising the remote management systems of several public utilities.

According to officials familiar with the case, the attackers gained remote access to critical mechanisms such as distribution pumps, control valves and water pressure gauges. This loss of functionality and monitoring forced local operators to deactivate the automated systems and immediately switch to manual operation to avoid losing control of the plants.

In the state of Georgia, the Clayton County Water Authority, which supplies some 300,000 customers in the Atlanta metropolitan area, confirmed that the cyber activity detected last month caused a drastic drop in water pressure.

The incident forced the agency to issue a boil-water advisory to the public as a precautionary measure, although regular service was restored a few hours later. Meanwhile, in Minnesota, the impact was more widespread, affecting more than 30 community water systems.

So far, government spokespeople have assured the public that the safety of drinking water has not been compromised and that supplies remain safe for consumption.

Federal agencies order immediate shutdown of networks

As the situation worsened, the Federal Bureau of Investigation (FBI), the Environmental Protection Agency (EPA), and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint alert.

In the statement, they warned that cyber threat actors remotely accessed the online infrastructure of water and wastewater systems, causing "a loss of monitoring and control functionality."

As an urgent countermeasure, the security agencies urged all water utilities nationwide to immediately disconnect their operational systems from the internet, in addition to strengthening their firewalls and updating the default passwords on industrial equipment.

Although federal investigators strongly suspect the attacks originated in Iran, intelligence agencies have not made a formal diplomatic attribution.

However, security analysts noted that the tactics employed bear an exact resemblance to the campaign carried out in 2023 by the group CyberAv3ngers, an organization directly linked to Iran's Islamic Revolutionary Guard Corps.