Signal Iran-Suspected Hacks of U.S. Water Systems Hit 12 States

Summary

Cyberattacks suspected to be linked to Iran against US water utilities had spread to at least 12 states as of August 13, 2026, according to Foreign Policy. The FBI, EPA and CISA first warned on July 30 that threat actors had remotely accessed water and wastewater system infrastructure in at least seven states, causing loss of monitoring and control functionality, with some facilities experiencing pressure loss and flooding. Minnesota was hit hardest, with at least 30 municipal water facilities affected, while Clayton County Water Authority in Georgia, serving 300,000 customers near Atlanta, issued a boil-water advisory after a pressure drop before restoring service within hours. The attack methods resembled a 2023 campaign by the Iran-linked group CyberAv3ngers, which exploited default passwords on control systems. Formal attribution to Iran remains unconfirmed, and President Trump publicly disputed the Iran connection, instead blaming Minnesota's state government. Investigators said the scope of the breaches could be larger than currently known, though officials confirmed no impact on drinking water safety.