US authorities are investigating a large-scale cyberattack targeting water systems in at least seven states, with Iran emerging as the primary suspect, The New York Times reported.
Although no disruption to drinking water supplies has been reported, US security officials have raised the alert level amid concerns that attackers attempted to interfere with control systems responsible for water quality and chemical levels.
The investigation began after Minnesota reported a breach of its water systems, followed by similar reports from additional states, including Michigan, the Times added. The FBI and the Environmental Protection Agency (EPA) confirmed that at least seven states have reported suspicious incidents, though no impact on public water supplies has been detected so far.
According to US reports, Iran is the leading suspect behind the cyberattack. However, officials stressed that the investigation is still in its early stages and that no conclusive evidence has yet been found to formally attribute responsibility to Tehran.
The incident has drawn comparisons to the Iranian cyberattack on Israel's water infrastructure in 2020. According to reports, that attack sought to alter chlorine levels in drinking water by infiltrating the control systems of water pumps. The attack was thwarted before significant damage was caused.
US officials believe the attackers this time attempted to seize control of systems monitoring water quality and chemical dosing, and may also have sought to trigger emergency protocols at multiple facilities. The Cybersecurity and Infrastructure Security Agency (CISA) has recommended that all water utilities disconnect sensitive control components from the internet to reduce the risk of further attacks.
US President Donald Trump downplayed the incident and questioned whether Iran was responsible. However, federal officials familiar with the investigation said Iran remains the leading suspect, even if it takes months to complete the inquiry.
Meanwhile, American cybersecurity experts warned that the attack represents a significant escalation. Unlike previous cyber operations focused on stealing information or disrupting computer networks, the current cyberattack directly targeted critical infrastructure affecting civilians' daily lives.