Story perspectives

Iranian Hackers Breach Water PLCs in Seven States

8/4/2026

Summary

Hackers Breach Water

Agencies reported hackers breached PLCs at water systems in seven states, affecting 30 Minnesota systems since July 27 2026.
The attackers changed IP addresses, locked operators out and caused loss and flooding.
Cynthia Kaiser, former FBI deputy, said Iranian-affiliated actors were responsible, as President Donald Trump blamed Governor Tim Walz.
Cybersecurity and Infrastructure Security Agency (CISA) urged utilities to disconnect PLCs from the internet, secure them, change credentials and keep overrides ready.

Summary

Iranian Hackers Target

Iranian-linked hackers have targeted U.S. critical infrastructure for a decade, hitting DoD contractors, hospitals and utilities.
Seven Iranians were charged for 2011-2013 DDoS attacks on 46 U.S. banks that cost tens of millions.
In 2013 a defendant accessed the Bowman Avenue Dam control system in Rye, New York, while the gate was offline.
The IRGC-linked “CyberAv3ngers” group exploited unsecured PLCs in 2023-2024, displayed pro-Israel messages and shut down Pennsylvania water pumps.

History

Historical Context

In 2014 the Iranian-linked Qassam Cyber Fighters launched Operation Ababil, flooding Bank of America, JPMorgan and other U.S. banks with DDoS traffic that the Department of Justice later tied to five Iranian nationals and cost roughly $30 million. The assault echoed earlier state-backed intrusions such as the 1998 Moonlight Maze and 2003 Titan Rain attacks, prompting the 2015 Cybersecurity Information Sharing Act.

1 of 3

Hackers Breach Water

Agencies reported hackers breached PLCs at water systems in seven states, affecting 30 Minnesota systems since July 27 2026.
The attackers changed IP addresses, locked operators out and caused loss and flooding.
Cynthia Kaiser, former FBI deputy, said Iranian-affiliated actors were responsible, as President Donald Trump blamed Governor Tim Walz.
Cybersecurity and Infrastructure Security Agency (CISA) urged utilities to disconnect PLCs from the internet, secure them, change credentials and keep overrides ready.

1 / 3