Iran suspected of targeting US water infrastructure in cyberattacks

Investigators are examining whether hackers linked to Iran are responsible for cyberattacks targeting water systems across multiple US states, including Minnesota and Arkansas. The suspected attacks follow a pattern of scanning for vulnerabilities to disrupt operations and undermine public trust in government institutions.

This security concern follows previous incidents, such as a 2022 breach of a water system in Guam attributed to China. While technical evidence is being collected to confirm the Iranian connection, officials note that such attribution can take weeks or months. The attacks highlight vulnerabilities in civilian water supplies, which often lack robust protection against digital intrusion.

Efforts to bolster security have faced legal hurdles. A 2023 Environmental Protection Agency (EPA) memo intended to mandate that states identify and fix vulnerabilities in water systems was blocked by a federal appeals court following lawsuits from Republican attorneys general in Arkansas, Iowa, and Missouri. These officials argued the regulation exceeded the EPA's authority and imposed undue financial burdens on small municipalities. A recent cyberattack on a water provider in western Arkansas occurred shortly after these regulatory efforts were halted.