Iranian Hackers Linked to Cyber Attacks on Minnesota Water Systems

A series of cyber attacks hit thirty water companies across Minnesota this week, and security researchers suspect an Iranian hacker collective known as CyberAv3ngers is behind the incident. Security firm Tenable reports that the disruption matches the tactics used by the group in past operations. Minnesota state IT agencies also confirmed the event was a coordinated cyber attack, although official US authorities have not yet formally attributed the blame.

The timing of the breach aligns with a recent warning from the US Cybersecurity and Infrastructure Security Agency. Officials previously stated that Iranian actors were actively targeting internet connected devices in critical sectors like water and energy. Tenable notes that escalating tensions between the US and Iran have led to a parallel rise in state sponsored cyber threats targeting vital infrastructure.

CyberAv3ngers has a history of high profile cyber incidents. Security firm Sophos previously linked the group to a 2020 attack on Israeli railway systems and a subsequent attempt to sell stolen data for bitcoin. Leaked internal documents from 2025 further exposed the operational structure of the group, showing ties to state directed efforts. Security experts advise critical infrastructure operators to monitor network traffic closely and maintain high alert levels.