Minnesota IT Services said state officials had yet to identify who was behind the attacks that took place Sunday and Monday. There were no reports that residents had been impacted by the attacks, though one city asked residents to conserve water for a couple hours while they tried to determine what was wrong.
The FBI, which is investigating, has not publicly identified a culprit and a spokesperson declined to say Thursday who the bureau thought might be responsible. The FBI, Cybersecurity and Infrastructure Security Agency and other agencies warned in an advisory last week that Iranian hackers have been targeting water and wastewater systems and the operational controls other critical infrastructure sectors.
Digital warfare has become ingrained in military conflict, and local water plants or healthcare facilities often lack the funds and know-how to install the latest software patches or take other security steps. That has made them a favorite target, both because of the relative ease of penetrating them and because of the panic such disruptions can cause.
Iran has the “geopolitical motivations” and a recent history of targeting water systems, said Cynthia Kaiser, the former deputy assistant director of the FBI's cyber division who has been closely monitoring threats to critical infrastructure from hackers linked to the country.
“I think most credible researchers and responders would be right to treat it like it’s Iran until proven otherwise,” added Kaiser, who is now the senior vice president of Halcyon’s Ransomware Research Center. “When it walks like a duck and talks like a duck, it's really important to call it out.”
Iran's interest in the operations of water systems inside the U.S. dates back years. In 2016, the Justice Department charged a group of Iranian hackers in connection with a cyberattack targeting a small dam near New York City.
