Federal cybersecurity agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), are currently investigating a coordinated cyberattack that targeted more than 30 municipal water systems across Minnesota. The Minnesota Information Technology (MNIT) agency issued an advisory on Tuesday confirming the ongoing investigation and their collaboration with federal partners to assess the scope and origin of the breach.

While the investigation is in its early stages, multiple reports suggest a connection to Iran. Wired reports that a leaked memo from the WaterISAC—an information-sharing group for water utilities—explicitly links the attacks to Tehran. Similarly, NDTV reports that the nature of the cyberattacks displays "telltale signs" associated with hacker groups known to be affiliated with the Iranian government. The Hill focuses on the official response, noting that the investigation is actively weighing evidence regarding the involvement of Iranian actors.

There is currently no consensus on the extent of the damage caused by these intrusions or whether the systems remain compromised. While the reports agree that the attacks occurred and that Iran is a primary subject of the investigation, they differ slightly in their sourcing: Wired relies on a leaked internal memo, while The Hill and NDTV rely on official advisories and general security assessments. None of the sources have provided a statement from the Iranian government regarding these allegations, nor have they detailed the specific technical methods used by the hackers to gain access to the municipal systems.