Five More States Joined the Water-Utility Count in Four Days, and No Agency Named the Actor

CBS News reported on or about 2 August that the United States was “investigating if Iran was behind” cyberattacks on water systems in seven states, naming Minnesota and Michigan. By 6 August, The Record, published by Recorded Future News, put the figure at twelve states, adding South Dakota and Georgia. That is a five-state expansion in roughly four days, and it is the only chartable series this desk found in the window. The per-state incident counts have not been verified here, and the disclosures have not been separated into new intrusions and old intrusions newly discovered — two different stories that the running total merges. The Hill carried a news piece on the morning of 7 August under the formulation “Iran-linked,” and Bloomberg used the same compound on 5 August.

The verbs are the story. The Washington Post wrote on 1 August that spy agencies “suspect” Iran is targeting water. CBS wrote “investigating if.” The Hill and Bloomberg wrote “Iran-linked.” No outlet retrieved in this window carries a flat declarative attribution to the Iranian state, and this desk found no formal on-the-record US government attribution statement. On the same morning it ran its news piece, The Hill sent a technology newsletter headlined “Is Iran to blame for America’s water system cyberattacks?” — a mainstream outlet putting the central question mark in its own subject line on day three. Fortune, on 5 August, framed the intrusion vector as unchanged default passwords on programmable logic controllers, which describes opportunistic scanning of exposed equipment rather than a directed campaign. No vendor has published named-APT research tying these intrusions to a tracked cluster. Tehran has issued neither denial nor claim.

Assessment: A disclosure curve is not an attack curve. Twelve states reporting is a measure of how many utilities looked and how many press offices published, and until someone separates fresh intrusions from newly-found old ones, the rising number will be read as escalation regardless of what it contains. The Fortune vector claim, if it survives a pull, points the other way: default credentials on internet-facing controllers are found by scanning, not selected by a state. Note what has not happened. Three days of coverage, no named US official attributing on the record, no denial from Tehran, no tracked-cluster research. The hedge is holding because the evidence has not yet forced it open — and hedges that hold this long usually break in one direction only when someone needs them to.