Nine Michigan water systems were targeted in a cyberattack, state officials confirmed.
The state joins at least six others affected by a coordinated series of attacks on water and wastewater infrastructure.
Michigan’s Department of Environment, Great Lakes, and Energy (EGLE) said the state first learned of the threat after receiving a federal cyber alert warning of attempts to tamper with operational technology at water systems.
“Following that notification, we received a small number of reports from Michigan communities indicating activity consistent with what federal agencies described,” EGLE said in a statement. “All systems continued to operate safely, issues were addressed by local operators, and there are no known impacts that posed a public health concern.”
At least seven states targeted
Michigan was not alone.
At least seven states in total have reported attacks, with Minnesota seeing the highest number of targeted systems.
In at least one case, hackers changed passwords and network settings, locking operators out and preventing them from controlling water flow.
Authorities have not officially named a suspect. However, U.S. intelligence and investigative officials view Iran as a primary suspect.
“The FBI is aware of recent public reporting around Water and Wastewater sectors,” the agency said. “The FBI and our interagency partners are fully engaged to protect critical infrastructure, and we remain well-equipped to protect against cyber threats of all varieties.”
Michigan systems monitoring situation
The Great Lakes Water Authority (GLWA) said its systems have not been impacted.
“The Great Lakes Water Authority is aware of reports regarding potential cyber threats targeting water systems and is closely monitoring the situation as it develops,” GLWA said in a statement. “At this time, GLWA’s water and wastewater systems continue to operate normally.”
The Michigan State Police (MSP) said it is actively coordinating with federal partners.
“Working with the Department of Environment, Great Lakes, and Energy, we are communicating with municipal water systems across the state and encouraging all facilities using the impacted software to take appropriate steps to secure their systems and follow applicable cybersecurity guidance,” MSP said.
Authorities have not publicly identified which Michigan municipalities were targeted. Several communities, including Oakland County, have confirmed they were not affected.
Cybersecurity experts urge vigilance
Talena Adams, founder of Brown Gurl Cyber and a local cybersecurity expert, said the attacks are part of a broader, escalating trend.
“We’re seeing more attempts against critical infrastructure than we did several years ago. For example: water, energy, health care, and transportation,” Adams said.
Adams added that many organizations are still working to modernize older technology while defending against increasingly sophisticated threats.
“Vigilance does not mean panic. It means stronger cybersecurity practices — like everyday practices like keeping systems updated, monitoring for unusual activity, training your employees and having an incident response plan,” Adams said.