After Minnesota, suspected Iranian hack spreads to water systems in Michigan

After Minnesota, suspected Iranian hack spreads to water systems in Michigan

Michigan on Saturday joined Minnesota in reporting cyberattacks on nine of the state's water systems, but an official maintained all systems were operating "safely," as a report said US law enforcement was treating Iran as the main suspect in those attacks.

Earlier this week, authorities said cyberattacks targeted over 30 water systems in Minnesota. The source of the attacks is being investigated, but they came amid warnings that Iranian hackers have been focused on such systems, with The New York Times reporting that at least five other unidentified states have been targeted.

The reports in Michigan surfaced after the state received a federal cyber alert Tuesday about attempts to tamper with operational technology at water systems.

Soon after, the state received "a small number of reports from Michigan communities indicating activity consistent with what federal agencies described," said Dale George, the director of communications at the state's Department of Environment, Great Lakes, and Energy. He later said nine systems were impacted.

"All systems continued to operate safely, issues were addressed by local operators, and there are no known impacts that posed a public health concern," George said in a statement.

The FBI, which is investigating, has not publicly identified a culprit and a spokesperson declined to say Thursday who the bureau thought might be responsible, though federal officials told the New York Times that Iran was the chief suspect, with Braham Mayor Nate George quoted as saying he was "pretty sure it's Iranian actors" but was hesitant to say so publicly. The FBI, Cybersecurity and Infrastructure Security Agency and other agencies warned in an advisory last week that Iranian hackers have been targeting water and wastewater systems and the operational controls of other critical infrastructure sectors.

"The FBI is aware of recent public reporting around Water and Wastewater (WWS) sectors," the agency said in a statement Saturday. "The FBI and our interagency partners are fully engaged to protect critical infrastructure and we remain well-equipped to protect against cyber threats of all varieties."

Digital warfare has become ingrained in military conflict, and local water plants or healthcare facilities often lack the funds and know-how to install the latest software patches or take other security steps. That has made them a favorite target, both because of the relative ease of penetrating them and because of the panic such disruptions can cause.

Iran's interest in the operations of water systems inside the US dates back years. In 2016, the Justice Department charged a group of Iranian hackers in connection with a cyberattack targeting a small dam near New York City.

Minnesota IT Services said that as of Thursday, there were no active requests from Minnesota communities for residents to modify usage of their drinking water. The state agency said most of the confirmed attacks involved technology that water systems use to remotely monitor and control equipment. It said that being impacted meant investigators confirmed there was malicious activity involving the system's technology and didn't mean every impacted community had their water service disrupted.

For a few hours on Monday, the city of Braham asked residents to minimize water use as they tried to determine why the water plant was offline. The city of about 1,700 people, located about 70 miles (113 kilometers) north of Minneapolis, said in a news release that the water plant outage was due to a cyberattack, but it didn't cause any issue with water quality.

The city said the attackers shut down the operating controls that shut down the well and water treatment plant. That left the city for a time only able to provide residents with the water held in the water tower.

In Plymouth, a city of about 80,000 located outside of Minneapolis, officials said on social media that their water infrastructure communications had been restored by Tuesday afternoon following a cyberattack.

During a cabinet meeting on Friday at the Camp David presidential retreat in Maryland, US President Donald Trump claimed without evidence that recent cyberattacks in Minnesota were the fault of the state, including Democratic Governor Tim Walz.

"We heard in Minnesota there was a cyberattack, and they blame it on Iran. I don't think so," Trump said. "I think I blame it on Minnesota because they're grossly incompetent."

Waltz responded on social media, saying Trump "knows exactly who is responsible for this attack, and knows that other states were hit too."

Trump has previously politicized major cyber incidents, including when in 2016 he urged Russia to hack Hillary Clinton's emails, or when he downplayed Russian hacking efforts in the 2016 elections.