Many were surprised last week when the US state of Minnesota reported that more than 30 of its state water systems had faced a "co-ordinated cyber-attack".
asserted
30 → report → attack
Days later the FBI warned cyber-attacks had been reported in seven states and "some of that activity degraded water operations".
asserted
some → warn → operations
The US Cybersecurity and Infrastructure Security Agency (Cisa) is reportedly probing a possible Iranian connection to the Minnesota attacks, according to US media.
uncertain
Agency → probe → media
Cisa would not comment.
asserted
Cisa → comment → ?
Although US President Donald Trump has not blamed Iran, cyber-experts tell the BBC it's likely the attack was directed by Tehran.
asserted
attack → blame → Tehran
Here's what you need to know.
Is Iran behind these attacks?
asserted
Iran → need → attacks
Morgan Wright, a former US state department anti-terror adviser, told the BBC that these kinds of attacks are usually attributed to North Korea or Iran.
"And who are we in conflict with right now?
asserted
we → tell → conflict
So they become, they go to the top of the listed terms of nations capable, and also having a desire to do something like this," he said.
asserted
he → become → this
US investigators are also looking into whether the hackers could have posed as Iran-based as a ruse to sow further discord amid the US war with Iran, according to the BBC's US partner CBS.
uncertain
hackers → look → partner
Jake Braun, former acting White House Deputy National Cyber Director, told the BBC that the Trump administration is involved in its own information war and therefore it might be unlikely to admit that Iran did infiltrate US water infrastructure, even if it was confirmed.
uncertain
it → act → infrastructure
At a cabinet meeting last Friday, Trump, a Republican, blamed "grossly incompetent" Minnesota officials, including Governor Tim Walz, for the water hack.
asserted
Trump → blame → hack
Walz, a Democrat, responded: "Trump knows exactly who is responsible for this attack, and knows that other states were hit too."
asserted
states → respond → attack
Iran has yet to comment on these incidents, but Tehran has repeatedly denied involvement in other cyber-attacks over the years, which include water systems, presidential campaigns, hospitals and a casino company in Las Vegas in 2014.
asserted
which → have → 2014
After a 2016 accusation linked to the targeting of banks and a dam outside New York City, Iran's foreign ministry spokesman said the US should prove such accusations.
asserted
US → link → accusations
Iran has "never had on its agenda any dangerous measures in cyberspace and does not support such moves", spokesman Hossein Jaberi Ansari said on state TV at the time.
asserted
Ansari → have → time
Does this fit a pattern for Iran?
asserted
this → fit → Iran
Iran has a documented history of this kind of activity, experts told the BBC.
asserted
experts → have → BBC
They noted that groups supportive of Iran, but located outside the country could be responsible.
"It makes it harder to assign attribution because if all of your attacks and groups are coming out of Iran, you can pretty much link it to Iran," Wright said.
uncertain
Wright → note → Iran
He noted that such a tactic offers bad actors plausible deniability.
asserted
tactic → note → deniability
"They do it so that their fingerprints aren't directly on it," he said.
asserted
he → do → it
Most of the Iranian cyber-attacks against the US and Israel this year have been carried out by a group called Handala, BBC Verify has found.
asserted
Verify → carry → group
The US justice department has linked the group to Iran, external, saying they have been working on behalf of the the Islamic Republic of Iran's Ministry of Intelligence and Security (MOIS).
asserted
they → link → Intelligence
Handala previously was accused of accessing some personal details and emails by FBI Director Kash Patel in the early days of the Iran war.
asserted
Handala → accuse → war
The last cyber-attack in the US claimed by Handala was in mid-June, BBC Verify found.
asserted
Verify → claim → June
The hackers claimed to have breached a water facility in California in response to a US attack on Iranian water infrastructure.
asserted
hackers → claim → infrastructure
Here are some of the other notable hacking operations that have been linked to Iran:
2026:
asserted
that → link → 2026
The justice department, external disrupted a hacking operation by Handala that targeted a medical technologies firm.
asserted
that → disrupt → firm
The operation also released sensitive information about members of the Israeli government and military
asserted
operation → release → government
Iran was accused , externalof hacking into US presidential campaigns to "stoke discord, erode confidence in the US electoral process, and unlawfully acquire information" about officials to help Iran.
asserted
Iran → accuse → Iran
US water and wastewater systems were hacked by a group accused of being affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC) both in 2023 and later in 2024, according to Cisa, external.
uncertain
systems → hack → Cisa
Equipment regulating water pressure in two Pennsylvania towns was temporarily closed due to the incident
2020:
asserted
Equipment → regulate → incident
Two Iranian nationals were indicted on charges, external of attempting to meddle in the presidential election by obtaining confidential US voter information and sending threatening messages for people to vote for Trump
2017: Iran-based hackers were also accused of a years-long ransomware effort targeting local governments, schools, healthcare and financial institutions, though Cisa noted, external that the group's activities were "likely not sanctioned" by Iran's government.
Could it endanger water supplies?
Experts told the BBC that the biggest threat of the hacks was not to the water supply itself, but in degrading public confidence in the security of their water.
uncertain
threat → indict → water
"They're attacking our trust in our government to be able to deliver basic services in a time when, you know, you've got a deeply divided country over the war," Braun said.
asserted
Braun → attack → war
It also cannot be ruled out that Iranian hackers might one day succeed in endangering US water supplies, experts added.
uncertain
experts → rule → supplies
Malicious efforts could cause a harmful distribution of chemicals, shut off water, or damage equipment, Wright suggested.
uncertain
Wright → cause → equipment
Cisa and the US Environmental Protection Agency have jointly said that cyber-attacks pose "a serious concern" for water utilities.
asserted
attacks → say → utilities
The US has 152,000 public drinking water systems and more than 16,000 wastewater treatment facilities.
asserted
US → have → systems
"Look, if you want to bring a nation to its knees, you go after two things, you go after power and water," Wright said.
asserted
Wright → look → power
How could this be prevented?
uncertain
this → prevent → ?
A lot of devices used in the water and wastewater processes are vulnerable to attack, because either there is old infrastructure or technology is older, Wright said.
asserted
Wright → use → attack
…and 52 more, not listed.
