CISA Named Iran in April; the FBI’s Alert on the Water Attacks Names Nobody

NPR published a reported piece by Jenna McLaughlin at 05:00 on 12 August on cyberattacks against US municipal water systems. In Braham, Minnesota, a town of roughly 1,700 people, a water operator found the pump at the treatment plant had stopped; crews took the plant offline while they investigated and the city asked residents to conserve while it drew on a backup tank. Minnesota state officials told NPR the attack targeted operating technology at more than 30 water systems in the state, Plymouth among them, in late July; the photograph accompanying the piece is dated 30 July in Plymouth. State IT teams characterised the cause to Braham as a “coordinated cyberattack” against industrial technology nationwide. “It’s not Braham in particular that’s being targeted. It’s the internet access points and the vulnerable technology,” mayor Nate George told NPR. “Everything’s connected to the internet in one way or another.” Cybersecurity experts and federal officials suspect Iran, NPR reports — suspect, throughout the piece.

Then the documents. The FBI’s 2026 alert is titled “Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions.” It names no state. CISA advisory AA26-097A is titled “Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure”; SecurityWeek’s write-up of it names Siemens, Schneider Electric and Rockwell Automation devices as the exposed equipment. NPR reports that the advisory first appeared in April 2026 and was updated days before the late-July attacks began; this desk has not verified that against the page’s revision history. The state count reached the wires as two figures from two publishers: NBC News, citing the FBI, reported municipal water systems in seven states targeted in a single week; Axios on 4 August put the number of states at 12. ABC News carried “at least 12” on anonymous sourcing. The incidents themselves are late July and the first days of August.

Assessment: The reporting is new; the attacks are two weeks old. What has not arrived in the interval is a formal attribution, and the vacuum is being filled backwards — an April advisory that says “Iranian-affiliated” is doing work the Bureau’s own July-August alert language declines to do. Distrust the state count as a trend: seven and twelve come from different publishers days apart, one of them anonymously sourced, and they are not a series. Distrust vendor “spike” figures absent a stated baseline. Note the incentive: a disruption wave nobody has formally owned stays available as pressure at the Oman table, and as a grievance, without either side having to defend it.