The FBI Says Seven States, Names None, and Every Iran Link Runs Through Anonymous Officials

Minnesota disclosed in the week of 27 July that operational-technology systems at more than 30 water and wastewater facilities had been targeted. SecurityWeek dates the intrusions to 26 and 27 July, notes only a handful of cities issued public statements, and reports one city briefly took its water plant down while most reported no operational impact. CBS News, citing Minnesota IT Services, reports most confirmed Minnesota cases involved technology used to remotely monitor and control water equipment, including programmable logic controllers. On Thursday 30 July the FBI, EPA and CISA issued a public service announcement. NBC News describes it as reporting incidents to the FBI with some malicious activity degrading water operations, and notes the announcement does not name the states. CBS reports the agencies warned of internet-exposed industrial controllers, and that in at least some cases federal authorities reported loss of monitoring and control functionality, leading to pressure loss and flooding.

The scope figure and the attribution move in opposite directions. CBS: “The FBI reported incidents in ‘at least seven states' but didn’t identify them.” Michigan joined Minnesota on Saturday; SecurityWeek names Michigan, South Dakota and Georgia as reportedly on the list, sourced to media reporting rather than official confirmation. Four of the seven remain unidentified. Against that, CBS reports its sources cautioned that they had not definitively attributed the attack, that their assessment could change as technical evidence is collected, and that they are probing whether the actor could have attempted to appear Iran-based as a way of stirring the pot amid the ongoing US conflict with Iran. NBC attributes the “hallmarks of Iranian meddling” characterisation to a single law enforcement official. The Yahoo wire aggregation reports officials telling The New York Times that the water attacks have not been definitively declared to have come from Iran, and that criminal hackers are less likely because there is no financial motive.

The public evidence carrying the Iran frame is three years old. CBS notes federal agencies previously confirmed that actors affiliated with Iran’s Islamic Revolutionary Guard Corps used a similar playbook in 2023, accessing multiple water and wastewater facilities by exploiting internet-connected controllers that retained default passwords. CISA’s current release, quoted by Yahoo News on 2 August, says threat actors targeting exposed PLCs “have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses,” activity that “has resulted in boil-water notices and sustained manual operations.” No jurisdiction has been named as issuing such a notice. Dale George, communications director at Michigan’s Department of Environment, Great Lakes and Energy, told CBS the state received “a small number of reports from Michigan communities indicating activity consistent with what federal agencies described,” and that “All systems continued to operate safely, issues were addressed by local operators, and there are no known impacts that posed a public health concern.” Minnesota IT Services said on 30 July there was no indication the breaches contaminated any municipal water supply.

Assessment: Read the sequence, not the headline. A CISA advisory numbered AA26-097A dates to early April; NBC dates a CISA/FBI advisory on Tehran-linked attempts against automated infrastructure devices to 22 July; the intrusions follow on 26–27 July; the PSA lands on 30 July. Outlets are compressing four documents into one event, and some indexes are timestamping the April advisory as two weeks old. The load-bearing caveat is the one CBS put in writing: its own sources are testing whether someone wanted to look Iranian. In a week when Washington is describing Hormuz as closed, a false flag is cheap and the incentive to accept one is high on both ends. Watch for the first on-the-record attribution, or a formal refusal.