Thirty towns and cities across Minnesota had their water systems knocked offline in a single coordinated cyberattack last month. The systems that keep clean water flowing to families — taken down in one wave.
That was just one state.
Utility companies across at least seven states have now reported cyberattacks on water and wastewater systems to the FBI. Some of those systems had to be shut down entirely, forcing operators into sustained manual operations to keep water moving. Michigan alone reported nine separate water system intrusions.
Federal agencies pointed to Iranian-affiliated hackers as the likely culprits behind the campaign. President Trump, speaking from Camp David on Friday, rejected the Iranian attribution and placed blame squarely on Minnesota's leadership, singling out Governor Tim Walz for the state's vulnerability. Whatever the source of the attacks, the result is the same — critical infrastructure that Americans depend on every single day proved to be a soft target.
Some will argue this is a federal responsibility, that Washington should have mandated cybersecurity standards for every water district in the country. That's an interesting position from the same crowd that spent years insisting the federal government had no business telling local utilities how to operate. The truth is simpler and uglier: the warnings existed, the advisories were published, the threat briefings were delivered, and the systems stayed vulnerable anyway.
We've watched the same pattern play out from cyberhackers with regards to pipelines, hospitals, school districts, and power grids. A foreign adversary probes for weaknesses. They find systems running on outdated software with default passwords and direct internet connections. They walk in. Everyone acts shocked. An advisory gets published. And six months later, the next batch of targets gets hit.
Thirty towns in Minnesota. Nine systems in Michigan. Seven states and counting. The advisories have advisory numbers now — AA26-097A, for anyone keeping a filing cabinet. The warnings keep getting more specific. The attacks keep getting bigger.