Water System Cyberattacks Spread to Michigan as FBI Widens Investigation

Water system cyberattacks have now surfaced in Michigan, where officials confirmed intrusions affecting nine separate utilities, arriving only days after Minnesota disclosed a far larger cluster of similar breaches. The FBI announced on Saturday that it is examining incidents in both states, expanding a probe that federal officials suggest reaches well beyond the two locations made public so far.

No responsible party has been named. That absence of attribution has not stopped the episode from becoming a political flashpoint, with sharply opposing explanations coming from the White House and from state leaders.

What Federal Investigators Have Disclosed

An advisory issued earlier in the week indicated that at least seven states have logged incidents tied to this activity. Only Minnesota and Michigan have been publicly identified, leaving five unnamed states presumably working through their own assessments.

In a statement, the bureau acknowledged awareness of recent reporting concerning water and wastewater utilities and said it was working alongside partner agencies to safeguard critical infrastructure. The agency described itself as prepared to counter cyber threats across the spectrum, though it stopped short of characterizing who might be behind this particular wave.

The federal advisory that preceded the disclosures focused on internet-facing programmable logic controllers, the small industrial computers that translate digital commands into physical actions such as opening a valve or starting a pump. When those devices sit exposed to the open internet with weak protection, they become an unusually direct path into the machinery of a treatment plant.

Michigan’s Account of Events

Dale George, communications director for Michigan’s Department of Environment, Great Lakes and Energy, said the affected utilities never stopped functioning safely. According to his account, the state received a federal cyber alert on Tuesday describing attempts to interfere with operational technology at water facilities.

Shortly afterward, a limited number of Michigan communities reported activity matching the description federal agencies had circulated. George emphasized that operations continued without interruption, an important distinction given how quickly public anxiety builds around anything involving drinking water.

Minnesota’s Larger Cluster

Minnesota disclosed its situation first, reporting suspicious activity at roughly thirty locations. Minnesota IT Services, the state’s technology agency, indicated that the majority of confirmed cases involved the remote monitoring and control systems that utilities rely on to manage equipment from a distance.

The agency was careful to draw a line between a compromised system and an actual service problem. As of Thursday, no active requests were in place asking residents to change their water usage, though some such requests had been issued earlier in the week and later lifted.

That nuance matters. An intruder reaching a control network is serious in its own right, but it does not automatically mean contaminated or interrupted supply. Much depends on what level of access was obtained and how quickly operators detected it.

Why Water Utilities Are Such Soft Targets

Municipal water plants tend to be among the weakest points in national infrastructure, and the reasons are structural rather than accidental.

• Budgets are thin. Many systems serve small populations and operate with limited revenue, leaving little room for dedicated security staff or modern equipment.
• Legacy equipment persists. Control hardware installed decades ago often lacks basic protections such as encryption or credential management, and replacing it is expensive and disruptive.
• Remote access expanded quickly. Utilities added internet connectivity for convenience and staffing efficiency, sometimes without corresponding safeguards.
• Ownership is fragmented. Thousands of independent operators mean no single authority can impose uniform standards or push updates across the sector.

Federal prosecutors have previously brought charges against Iranian nationals accused of targeting water infrastructure, a history that shapes how officials interpret the current pattern.

The Political Divide Over Attribution

The question of blame has split along familiar lines.

Asked about the Minnesota intrusions, President Donald Trump declined to point at any foreign actor. He instead suggested the state itself was responsible, saying he believed Minnesota was behind the incidents and rejecting the idea that Iranian hackers were involved. He offered no supporting evidence or elaboration.

Minnesota Governor Tim Walz took the opposite position, indicating he believes Iran carried out the attacks. He also connected the vulnerability to reductions in the federal workforce, arguing that staffing cuts weakened the country’s defensive posture. Walz asserted that the president is aware of who is responsible and aware that additional states were affected.

That exchange has effectively turned a technical security incident into a partisan argument, complicating public understanding at precisely the moment clarity would be most useful.

The Broader Context

The intrusions arrive against a backdrop of escalating rhetoric. Throughout the ongoing conflict, the president has repeatedly raised the possibility of striking civilian infrastructure inside Iran, specifically naming power generation and water desalination facilities as potential targets.

Whether or not that rhetoric is connected to the current activity, it forms the environment in which these breaches are being interpreted. Attacks on water systems occupy a particularly sensitive category because they blur the line between military and civilian targets.

What to Watch Next

Several questions remain unresolved. The identities of the five unnamed states have not been released, and it is unclear whether those cases involve the same techniques. Investigators have not indicated when or whether they will formally assign responsibility, a process that typically takes weeks or longer.

For residents, the practical guidance has not changed: follow notices from local utilities regarding water usage. For operators, the immediate priority is reviewing whether control hardware is reachable from the open internet and closing that exposure where it exists.

The wider lesson is uncomfortable. A sector built for reliability rather than adversarial defense is now being tested by actors who understand exactly where the seams are.