Federal and state officials are investigating a series of cyberattacks that impacted water and wastewater systems across at least seven U.S. states. Preliminary assessments by U.S. intelligence agencies indicate that actors affiliated with Iran may be responsible for the disruptions. The FBI confirmed incidents in "at least seven states" but has not publicly identified them.
The cyber activity affected operational technology at water facilities, leading some utilities to switch to manual operations. A joint alert from the FBI and the Environmental Protection Agency warned that malicious actors were tampering with internet-connected programmable logic controllers (PLCs) used by water and wastewater utilities. These attacks have, in some instances, resulted in loss of monitoring and control functionality, causing pressure loss and flooding. The Cybersecurity and Infrastructure Security Agency (CISA) advised water facilities to disconnect vulnerable equipment, particularly PLCs, from the internet to prevent further attacks.
While the investigation is ongoing and definitive attribution has not been made, U.S. officials and sources familiar with the incident are probing Iranian involvement. These sources cautioned that the assessment could change as more technical evidence is gathered. There is also an inquiry into whether the actor might have attempted to impersonate an Iran-based entity to stir geopolitical tensions. U.S. intelligence agencies have previously warned that Iran has been targeting internet-exposed devices controlling operations at water, wastewater, and energy facilities in the U.S. In July, federal cybersecurity authorities specifically warned that Iranian hackers were exploiting vulnerable PLCs.
President Trump has publicly questioned Iran's involvement, suggesting instead that Minnesota, one of the affected states, might be responsible.
Separately, the FBI is exploring the use of artificial intelligence to enhance its crime detection capabilities. The agency is seeking AI-powered systems that can analyze vast government databases to identify potential threats and flag individuals for scrutiny before crimes occur. This initiative aims to automate threat-screening processes, allowing for quicker identification of criminal activity and national security threats. The FBI emphasizes that human analysts will remain accountable for actions taken based on AI-generated leads.
In other technology-related legal news, Elon Musk's company xAI has sued the state of Minnesota over its new law banning "nudification" technology. The law, which prohibits the creation of AI-generated non-consensual intimate images, is set to take effect on August 1. xAI argues that the statute is overly broad and infringes on constitutionally protected speech, potentially exposing the company to significant fines. A federal judge recently denied xAI's request for a temporary restraining order to block the ban, citing the company's delay in seeking relief. xAI has stated it will restrict its image-editing features for Minnesota users rather than face potential penalties.
Additionally, Russia has charged Telegram founder Pavel Durov with aiding terrorist activities. The Federal Security Service of Russia (FSB) accused Telegram of failing to remove content used by Ukrainian special services and extremist organizations for planning attacks and cyber fraud. Durov has been placed on an international wanted list. The FSB also alleged that a Telegram chatbot was used to recruit Russian citizens for sabotage and terrorist acts.