FBI investigates cyberattacks on water systems in several states

Michigan received a “a small number of reports from Michigan communities indicating activity consistent with what federal agencies described,” EGLE spokesperson Dale George said in a statement.

“All systems continued to operate safely, issues were addressed by local operators, and there are no known impacts that posed a public health concern,” George added.

This comes as more than 30 water systems in Minnesota faced similar attacks last week, with the FBI and the Environmental Protection Agency reporting Thursday that cyberattacks had affected at least seven states.

According to federal officials, some of the attacks have “degraded water operations.”

President Donald Trump last week dismissed reports that the attacks could be coming from Iranian operatives, instead calling out Minnesota’s “corrupt governor” Tim Walz.

“I just want to mention that we heard in Minnesota there was a cyberattack, and they blame it on Iran,” Trump said at the start of a cabinet meeting on Friday. “I don't think so. I think I blame it on Minnesota because they're grossly incompetent . . . They like to say, oh, it was Iran. Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota.”

Water systems in Georgia and South Dakota were also named as victims of similar cyberattacks. The other three states have not been named.

Walz responded to those claims.

“Trump knows exactly who is responsible for this attack, and knows that other states were hit too,” he posted to social media. “This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran.”

The FBI did not specify Iran in its statement, instead calling the hackers “malicious cyber actors.”

“The FBI is aware of recent public reporting around Water and Wastewater (WWS) sectors,” the department said in a statement on Saturday. “The FBI is actively engaged with victims . . . This guidance emphasizes our joint commitment to support critical infrastructure entities against malicious cyber actors attempting to harm the United States.”

The hackers allegedly targeted industrial devices used in water treatment facilities.

Minnesota IT Services said in a statement last week that this was an attack on the state’s critical infrastructure, but it was prepared.

“This incident demonstrates why Minnesota has invested in strong cybersecurity capabilities and partnerships,” said John Israel, MNIT Assistant Commissioner and Minnesota Chief Information Security Officer. “Our response worked as intended, enabling agencies at every level of government to rapidly coordinate, contain the incident, and help prevent more serious impacts to critical services.”

Tatyana Bolton, the executive director of the Operational Technology Cybersecurity Coalition, called these attacks a “wake up call” for the need for more security.

“We believe the U.S. government must take tangible and immediate action to enhance the security and resilience of our critical infrastructure,” Bolton said. “To date, we have been lucky that a more catastrophic incident hasn’t occurred. We can no longer rely on luck. We must act.”