6 ms·
Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran
- phendrenad2 2mo agoIs this the true reason for the cyclosporasis outbreaks?
- jfengel 2mo agoNah. Cyclospora is a parasite, not a virus. [Riffing on the gag, not an actual misunderstanding, just to be clear.]
- hubbahubbahubba 2mo agoCan we still blame Mexico, Taylor Farms and Taco Bell as well?
- xvxvx 2mo agoTaco Bell is secretly funded by Iran and North Korea and invented covid…
- malcolmgreaves 2mo ago> “I think Minnesota is behind it,” Mr. Trump said on Friday in response to a reporter’s question about Iran’s possible involvement, What a coward and a traitor to the American people.
- rozal 2mo agoContext: He said the state was “behind it” because of gross incompetence and that he doesn’t buy the Iran attribution
- deleted 2mo ago[deleted]
- baron816 2mo agoHe knows he brought these attacks with his war, but he doesn’t take the blame for anything.
- AnimalMuppet 2mo agoEither he knows and doesn't want to take the blame, or he doesn't know. I'm not sure which one is worse.
- jeroenhd 2mo agoHe stopped going to security briefings before, maybe he simply doesn't care to know.
- puttycat 2mo ago> he brought these attacks with his war I'm no Trump supporter and this war was a big mistake, but justifying a nation poisoning another's civilian water supply is a bit upside down.
- mplanchard 2mo agoYeah, what could we possibly have done[0] to justify an attack on our water supply? [0]: https://www.commondreams.org/news/iran-water-desalination-plants https://www.commondreams.org/news/iran-water-desalination-pl...
- throw1234567891 2mo agoAsk the people of Flint, Michigan?
- krapp 2mo agoWe don't follow "rules" in war anymore, according to "Secretary of War" Pete Hegseth. We show no quarter and take no prisoners, we pursue "maximum lethality, not tepid legality." That's American policy now. The gloves are off, no holds barred, everything and everyone is on the table. So I guess we reap what we sow.
- vjvjvjvjghv 2mo agoIt was probably the same (imaginary) people who damaged the lining of the Reflecting Pool. I think we should think about making blatant lies by politicians a crime.
- dylan604 2mo agoWhat's one more crime compared to all of the ones they've already committed?
- lysace 2mo agoThe Federal Bureau of Investigation (FBI) and Environmental Protection Agency (EPA) are issuing this Public Service Announcement (PSA) to warn critical infrastructure asset owners and operators that malicious cyber actors (MCAs) are conducting cyber attacks targeting Operational Technology (OT) devices, including Rockwell Automation/Allen-Bradley Programmable Logic Controllers (PLCs), specifically MicroLogix 1100 and 1400 series. Since 27 July 2026, Water and Wastewater Sector (WWS) utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations. While the FBI has only observed this behavior with the referenced Rockwell PLCs, similar considerations should also be made with other branded PLCs. After remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality. To reduce the risk of compromise, the FBI and EPA recommend removing PLCs from direct internet exposure via secure gateway and firewalls, setting up strong, unique passwords, and utilizing an access control list (ACL) to allow only authorized communication between expected control system devices. https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-...
- radicality 2mo agoDid they literally just leave the water supply plant management software out available on the open internet? Hard to even call this a hack!
- alwa 2mo agoI mean Some of these municipal water plants in the US are independently operated by municipalities of awfully few people and even fewer resources to spare, often serving relatively vast areas… It’s probably not how you or I would set things up—especially after many years of warnings and slick best practices guides-but I can sympathize with “if it’s not broken…”-style maintenance, especially at the local level. These things have lifespans measured in decades, and budgetary cycles to match… and for all of CISA’s good work (on limited budgets, and with power that’s more persuasive than fearsome) [0], it seems hard to get all 148,000 [1] system operators to afford to care, much less to afford to fix things—much less to check their work. [0] https://www.cisa.gov/topics/industrial-control-systems https://www.cisa.gov/topics/industrial-control-systems , and https://www.gao.gov/assets/d24106576.pdf https://www.gao.gov/assets/d24106576.pdf for an idea of the staffing they’re doing it with… [1] https://www.epa.gov/dwreginfo/information-about-public-water-systems https://www.epa.gov/dwreginfo/information-about-public-water...
- BoardsOfCanada 2mo agohttps://archive.is/fa2Xj https://archive.is/fa2Xj
- aaron695 2mo ago[dead]
- mannanj 2mo agoIf I was in a power position, I could theoretically channel this water into my own private reservoirs and locations like private land, bunkers, etc to weather a disruption, and blame Iran and it would be really hard to validate. I mean if I was in a power position I would have also disrupted those in positions who would be validating me, made journalism much harder and have algorithms with LLM-enhanced astroturf accounts running to label any questioning of the official narrative as conspiratorial or tin-foil hat. I would probably be on sites like this downvoting people who said things like this. Yes. That's how I would do it. edit: Oh I might even consider channeling that water to my data center friends!
- maxerickson 2mo agoYou know water is kind of big right?
- irishcoffee 2mo agoI understand being mad, I also get mad. This is a bit unhinged.
- throw1234567891 2mo agoWe used to say that about some things before Snowden. And then there was Snowden.
- krapp 2mo agoBut they wouldn't need to false-flag an excuse to capture and privatize resources, they could and would just do that openly. The government can just take whatever it wants through eminent domain.
- deleted 2mo ago[deleted]
- firefax 2mo agoWasn't there a Defcon or Derby talk about this years back? (The insecurity, not the Persian angle) Struggling for a source. Guy had the energy of that one Simcity 2000 character who bugs out if you cut back on funding that you'll regret it. Early twenty aughts IIRC?
- bradly 2mo agoNot sure about defcon, but Buckminster Fuller wrote waay back in the sixties about the New York's vulnerability to a fresh water supply attack. If you haven't read it Operating Manual For Spaceship Earth is one of my favorite books. https://archive.org/details/operatingmanualforspaceshipearthbuckminsterfuller1969/page/n39/mode/2up https://archive.org/details/operatingmanualforspaceshipearth...
- firefax 2mo agoI'll throw it on my list, I've got a pretty big backlog right now.
- cineticdaffodil 2mo agoI think this landscape is littered with simulated systems as honeypot. Once you have it a normal adversary would stop searching, besides regular checks that the gun still works.
- krautburglar 2mo agoThey always point to a state actor to skirt liability for their own shitty IT work. Then the dim evil journalists swallow it whole, later regurgitating it for their eager little baby bird subscribers. If there were actual penalties for rawdogging a PLC (or any other control system) on the internet, shit like this wouldn’t happen.
- dylan604 2mo ago<adjustsTinFoilHat> The Trump plan in Iran is not working. Gotta make them look like the evil bogeyman to get people to support further action.
- krautburglar 2mo agoIran is beside the point. There is always a convenient bogeyman: China, Russia, North Korea… They sow discord between peoples to cover-up the ineptitude of domestic institutional assholes.
- garciasn 2mo agoBlacks. Homosexuals. Communists. Islamics. Hispanics. Liberals. Intellectuals. There’s always an other. That’s what the Republicans have been doing for decades.
- neves 2mo agoIn this war initiated by USA and Israel, it isn't Iran who's attacking civil targets.
- applicative 2mo ago[flagged]
- lorreyfum 2mo agoWhere does all the money go? Not to cyber apparently.
- nerevarthelame 2mo agoDOGE eliminated 1/3 of CISA staff in 2025. Trump reduced the 2026 CISA budget by $491 million (17%). Trump intends to slash their budget by an additional $707 million in 2027. The ICE budget was just increased by $70 BILLION, bringing its total to >$200 billion.
- lorreyfum 2mo agoCISA staff doesn’t do security patches and updates on local water supplies. You’re mixing a lot of stuff around there, none of it relevant to the discussion.
- halJordan 2mo agoCISA is the one who mandates these controls and who manages the public/private relationship. Who issues the active exploration warnings. Who suggests legislation to prevent this in the future, including mandatory software updates. If your question was only a trite recitation of the fact that private enterprise consistently refuses to practice cybersecurity then you've added nothing. If your question was about who watches the watchers and what we're doing about the fact that private enterprise refuses to practice cybersecurity then it was an incredibly relevant statement.
- lorreyfum 2mo agoA public water authority needs to step it up, at least to the level of other public water authorities who don’t have the problem. Simple matter of disconnecting it from the internet and running security patches, c’mon man!
- newfriend 2mo ago[flagged]
- londons_explore 2mo agoPeople use 1000x more water than they need to drink. If a water supply chain attack happened, we would just distribute bottled water for drinking, and people would go without washing for a few days whilst the issue was sorted. Bottled water production is already big enough that delivering a bottle a day per person in new York is within the scale of the current production and retail networks scope. It wouldn't cause the mass casualties an enemy might assume.
- BigTTYGothGF 2mo agoExactly how big do you think those bottles would be?
- nerevarthelame 2mo agoIran doesn't need to cause mass casualties. They just need to make US citizens hate the war in Iran.
- genocidicbunny 2mo agoTrouble is, there's a good chance that a large portion of the population will then be in favour of ending the war by escalating it to the point of flattening Iran. And that portion of the population has somewhat of a correlation with the political base of the current administration.
- ChoGGi 2mo agoWhat's he gonna do? Nuke Iran? You know, I said that as a joke, but... It's getting hard to tell jokes from reality with this administration (excluding roasts at the WHCD).
- swat535 2mo agoHow are you going to flatten Iran? A country twice the size of Texas with 90M people. You would have to fire your entire nuclear arsenal and commit mass genocide. Even then, you may not be able to destroy the missile cities, many of them were built to be nuclear resistant.
- deleted 2mo ago[deleted]
- OutOfHere 2mo agoWhy are water systems still on the internet? They should be completely cut off. If necessary, remote access must be from dedicated devices only, only to a mirrored view, and never for remote control.
- mikewarot 2mo ago>state and local officials throughout the country were on high alert for potential problems in vulnerable computers that are commonly used to monitor and adjust water quality, including chemical-treatment levels and water pressure. You don't need a full bidirectional internet connection for remote monitoring, and data diodes are a relatively cheap way to monitor them in complete safety. Completely stopping ingress of control (using above mentioned data diodes) is relatively easy, and should be legislated into being the norm.
- mindslight 2mo agoPlease expound upon this "data diodes are a relatively cheap way to monitor them in complete safety". I'm familiar with the concept, but do not know they are in widespread use, and off-the-shelfish enough to be considered "cheap". To me, the fundamental problem is that our protocol stacks are all built on an assumption of bidirectional interaction, making "data diodes" require bespoke engineering to define the correct data structures of a type that can be thrown over a wall. Like sure it's easy to cut one ethernet pair, or one serial line wire, but building up a software stack that can use that for one-way communication still seems like a hassle.
- mikewarot 2mo agoThe software stack is the hassle. Let's assume you want to monitor the SCADA system doing water treatment, or some other critical task, on an air-gapped network. You add server to the network, it's purpose is to query, the SCADA system and get the status, error logs, process parameters, whatever you need, and spool them into a directory on a drive. A second process on that server then spools them off via a one-way optical link (high speed optocoupler, specially modified fiber link, etc) using some sort of protocol that broadcasts all the collected information, along with some form of error correction, on a continuous basis. It will do this until the end of time, never knowing if the information was recieved. The outside server then monitors the broadcast stream, using it to update it's own directory with the relevant data, and makes it available like any normal server to an internet connection. Because the connection has only one physical link, and it CAN NOT be reversed, ingress of control is completely prevented. Yet you can monitor the system from the outside, and never have to worry about compromise of the air-gapped network. A pair of raspberry pi's with ethernet (and not wifi/bluetooth) could do the job. Once it works, the "outside" host could be hacked, but it won't, CAN'T influence the other host, so things remain actually safe from remote hacking. [1] https://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network
- 1vuio0pswjnm7 2mo ago28 Jul 2026 22:47:42 UTC Coordinated cyberattack disrupts water utilities in 30 Minnesota communities https://statescoop.com/coordinated-cyberattack-disrupts-water-utilities-in-30-minnesota-communities/ https://statescoop.com/coordinated-cyberattack-disrupts-wate... https://news.ycombinator.com/item?id=49091021 https://news.ycombinator.com/item?id=49091021 [ok] 29 Jul 2026 07:47:11 UTC Cyberattack targeted 30 Minnesota water systems https://mn.gov/mnit/media/blog/?id=38-761869 https://mn.gov/mnit/media/blog/?id=38-761869 https://news.ycombinator.com/item?id=49094533 https://news.ycombinator.com/item?id=49094533 [ok] 30 Jul 2026 17:08:40 UTC U.S. Sees Iran as Likely Behind Cyberattack on Minnesota Water Systems https://www.nytimes.com/2026/07/30/us/politics/minnesota-water-cyberattack-iran.html https://www.nytimes.com/2026/07/30/us/politics/minnesota-wat... https://news.ycombinator.com/item?id=49112788 https://news.ycombinator.com/item?id=49112788 [ok] 30 Jul 2026 23:12:21 UTC A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran https://www.wired.com/story/a-leaked-memo-ties-cyberattacks-on-minnesota-water-utilities-to-iran/ https://www.wired.com/story/a-leaked-memo-ties-cyberattacks-... https://news.ycombinator.com/item?id=49117018 https://news.ycombinator.com/item?id=49117018 [ok] 31 Jul 2026 13:35:38 UTC US investigating if Iran was behind cyberattack on water systems in seven states https://www.cbsnews.com/news/us-investigating-iran-cyberattack-minnesota-water-systems/ https://www.cbsnews.com/news/us-investigating-iran-cyberatta... https://news.ycombinator.com/item?id=49122974 https://news.ycombinator.com/item?id=49122974 [ok] 31 Jul 2026 18:17:17 UTC Iranian hackers likely behind Minnesota municipal water cyberattack https://www.axios.com/local/twin-cities/2026/07/30/report-iranian-hackers-minnesota-water-systems-nytimes-cyberattack https://www.axios.com/local/twin-cities/2026/07/30/report-ir... https://news.ycombinator.com/item?id=49126761 https://news.ycombinator.com/item?id=49126761 [ok] 31 Jul 2026 23:55:10 UTC Cyberattack on water systems in multiple states has US officials on edge https://www.cnn.com/2026/07/31/politics/sweeping-cyberattack-us-water-systems https://www.cnn.com/2026/07/31/politics/sweeping-cyberattack... https://news.ycombinator.com/item?id=49129814 https://news.ycombinator.com/item?id=49129814 [ok]
- ChrisArchitect 2mo agoIf a number of these submissions didn't get any upvote traction or more importantly didn't get much discussion, then this unwieldly list of links is not helpful. It's spam.