Cybersecurity Concerns: Michigan and Minnesota Targeted in Water System Cyberattacks

Michigan reported recent cyberattacks on nine of its water systems, joining Minnesota, which experienced similar incidents on over 30 systems earlier in the week. Despite these attacks, state officials confirmed that all water systems continue to operate safely.

The attacks in Michigan were discovered following a federal cyber alert on Tuesday addressing threats to operational technology within water systems. Dale George, director of communications at Michigan’s Department of Environment, Great Lakes, and Energy, confirmed the incidents involved nine systems. He stated that there were no impacts posing a public health concern and issues were resolved by local operators.

The FBI is investigating these attacks but has not publicly identified those responsible. The agency, alongside the Cybersecurity and Infrastructure Security Agency and other partners, previously warned about Iranian hackers targeting critical infrastructure, including water and wastewater systems.

The FBI is committed to protecting critical infrastructure and is well-prepared to address various cyber threats.

Digital warfare is prominent in military conflicts today, often striking local facilities that lack resources for advanced security measures. This makes them easy targets, capable of causing public panic. Iranian efforts to infiltrate U.S. water systems date back several years. Notably, in 2016, Iranian hackers were charged with attacking a small dam near New York City.

Minnesota IT Services reported no active requests for residents to alter water usage. Most attacks involved technology that handles remote monitoring and control of water system equipment. The impact indicated malicious activity but did not necessarily disrupt water services in all communities.

In Braham, Minnesota, a cyberattack led the city to temporarily ask residents to reduce water usage as the water plant system went offline. The plant’s operating controls were shut down by attackers, leaving only water from the tower for residents of the city, which is located about 70 miles north of Minneapolis.

Meanwhile, in Plymouth, a suburb of Minneapolis, officials restored water infrastructure communications by Tuesday after a cyberattack.

During a Cabinet meeting at Camp David, President Donald Trump linked the cyberattacks to Minnesota’s state government without providing evidence. Minnesota Governor Tim Walz responded, stating Trump’s remarks held no basis and clarified that the attacks affected multiple states.