The coordinated cyberattack campaign that first struck more than 30 Minnesota water utilities on July 26–27 has expanded dramatically. The FBI previously reported that since July 27 water and wastewater utilities in at least seven states had reported incidents affecting operations; as of August 5, ABC News is reporting that at least 12 states are now remediating attacks, including several facilities in Michigan. Georgia’s Clayton County Water Authority confirmed on Monday that it “experienced a temporary disruption affecting a portion of its operational systems and water service in parts of north Clayton County” and is investigating the cyber activity. South Dakota has also announced incidents.
Multiple sources, including federal officials who spoke on background, point to Iran as the actor behind the campaign. Iranian-linked groups have since 2023 repeatedly targeted a specific type of operational technology used by US water and wastewater facilities, and CISA has previously issued advisories warning the water sector about these exact vulnerabilities. The US government has not made a formal public attribution yet. The pattern of attacks — hitting the OT layer that controls physical water treatment processes rather than the IT layer — is consistent with a campaign designed to pre-position for potential future disruption or to demonstrate reach, rather than to immediately harm water quality. No contamination events have been confirmed at any of the affected utilities.