Minnesota reports breach in water systems
Last week, Minnesota officials disclosed that over 30 of the state's water systems had been hit by a coordinated cyber-attack. The revelation caught many off guard, particularly after the FBI had recently issued alerts about cyber attacks affecting water operations across seven different US states. According to media reports, the US Cybersecurity and Infrastructure Security Agency is currently investigating whether Iran might be involved in the Minnesota attacks, but Cisa has not made any official statements on the issue.
While President Donald Trump has not directly accused Iran of being responsible, several cyber experts believe that Iran could be behind the attacks. Morgan Wright, who once served as a U.S. state department anti-terrorism adviser, told the BBC that given the current U.S. conflict with Iran, it is a top suspect. He argues that Iran both has the technical ability to conduct such operations and a strong motive to do so.
Cyber-attack patterns and possible denial of responsibility
Iran has a well-documented history of cyber activities targeting US and Israeli interests, and experts suggest some attacks that seem to be linked to Iran may actually be carried out by groups operating outside Iran. This method helps attackers avoid direct attribution. For instance, groups such as Handala, which the US justice department has connected to Iran, have been responsible for various cyber attacks, including hacking a medical technology firm and breaching water infrastructure in California.
The US justice department has linked the Handala group to Iran’s Ministry of Intelligence and Security. In past incidents, Handala has claimed responsibility for hacking attacks in retaliation for US actions in Iran. Both 2023 and 2024 saw Cisa report attacks on US water systems, which were attributed to a group associated with Iran’s Islamic Revolutionary Guard Corps.
Historical Iranian cyber operations
Iran has been accused of interfering in US presidential campaigns and attempting to influence election outcomes. In 2020, two Iranian nationals were indicted for seeking to obtain confidential voter data and for sending messages urging people to support Trump. In 2017, hackers based in Iran were linked to a series of ransomware attacks affecting various sectors in the US, though Cisa noted these may not have been officially sanctioned by the government.
In 2014, Iran was connected to a cyber attack that impacted a Las Vegas casino company, hospitals, and US presidential campaigns. After accusations in 2016 involving the hacking of a dam in New York, Iran’s foreign ministry called for proof to back these claims. Despite these accusations, Iran has consistently denied any involvement in dangerous cyber activities.
According to the BBC, US investigators are also examining the possibility that hackers might have faked being based in Iran to add confusion in the US-Iran war. Meanwhile, Trump criticized Minnesota officials for the breach, but Governor Walz refuted the claim, asserting Trump knows who is to blame.
The US justice department has also identified Handala as the group behind several cyber-attacks in recent years. Their activities included targeting a medical technology firm in 2026 and releasing sensitive data about Israeli officials and the military. In 2024, Iran was accused of cyber interference in US presidential campaigns, aiming to undermine confidence in the electoral process. These incidents, along with past attacks on water systems, demonstrate a consistent pattern of cyber operations linked to Iran.
Handala, which is associated with Iran’s Ministry of Intelligence and Security, has repeatedly claimed responsibility for attacks in response to US actions. Their tactics often include plausible deniability, making it difficult for investigators to pinpoint direct Iranian government involvement. Experts suggest that by working through external groups, Iran can execute cyber attacks without being directly exposed.
Despite repeated accusations, Iran has not commented on the recent water system breaches in the U.S. However, the country has a history of denying involvement in cyber attacks, even when evidence seems to point toward its government or affiliated groups. This pattern of responses raises questions about transparency and accountability.
