Memo Links Cyberattacks on Minnesota Water Utilities to Iran

A leaked memo from the Water Information Sharing and Analysis Center (WaterISAC) links dozens of cyberattacks targeting water utilities in Minnesota to actors based in Tehran, Iran. The document, obtained by WIRED and reported on July 30, 2026, indicates a coordinated effort to compromise critical water infrastructure within the state.

WaterISAC serves as the primary security information hub for the water and wastewater sector. The memo’s findings suggest that the attacks were not isolated incidents but part of a broader pattern of cyberespionage or disruptive activity originating from Iranian sources, according to the WIRED report.

Iranian Cyber Activity Targeting Minnesota Infrastructure

The WaterISAC memo identifies a series of intrusions specifically aimed at Minnesota’s water systems. While the full extent of the operational impact was not detailed in the leaked document, the attribution to Tehran points to a state-sponsored or state-aligned effort to gain access to industrial control systems (ICS) used to manage water treatment and distribution.

Cyberattacks on water utilities typically target programmable logic controllers (PLCs) or human-machine interfaces (HMIs) to alter chemical levels or disrupt water flow. The memo’s focus on Minnesota suggests a targeted geographic campaign rather than a random series of opportunistic hacks.

The Role of WaterISAC in Critical Infrastructure Defense

WaterISAC operates as a specialized threat-intelligence entity that allows utilities to share vulnerability data and attack signatures without public exposure. By attributing these attacks to Iran, the organization provides a framework for utilities to implement specific defensive measures against known Iranian tactics, techniques, and procedures (TTPs).

The leak of this memo highlights the tension between the need for confidential information sharing among utility operators and the public’s right to know about threats to essential services. The document provides evidence of a persistent threat actor attempting to penetrate the security layers of municipal water providers.

Context of Iranian Cyber Operations

Iran has a documented history of targeting critical infrastructure globally. Previous campaigns have focused on energy sectors and water management systems in both the Middle East and North America. These operations often utilize a mix of credential harvesting, phishing, and the exploitation of unpatched vulnerabilities in remote access software.

The targeting of Minnesota utilities aligns with a broader trend of adversarial nations probing the resilience of U.S. regional infrastructure. Such activity is often categorized as cyberespionage, where the goal is to establish a foothold in a network for future leverage or disruption during geopolitical tension.

Security analysts note that water utilities are often more vulnerable than larger power grids due to limited budgets for cybersecurity personnel and a reliance on legacy hardware that lacks modern authentication protocols.