State and federal authorities are assessing claims that a cyberattack affecting more than 30 Minnesota water systems was carried out by hacking groups with ties to Iran, according to a report by a university-run cybersecurity outlet.
Who claimed responsibility
The report, published by Threat Beat — a project of Auburn University’s McCrary Institute for Cyber and Critical Infrastructure Security — says two groups, APT IRAN and CyberAv3ngers, posted messages on Telegram claiming involvement in the incident. Threat Beat stated that APT IRAN posted a message taking direct responsibility.
“The attack on Minnesota was the work of the CyberAv3ngers group and us, and we take direct responsibility for it.”
The McCrary Institute is a nonpartisan research program that advises on cybersecurity matters and is recognized for its work on critical infrastructure threats.
Alleged links to Iran and prior activity
Threat Beat’s reporting notes that the groups were already believed to be closely linked. U.S. government assessments and the Rewards for Justice program have previously associated CyberAv3ngers with the Islamic Revolutionary Guard Corps, and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has described the IRGC as a designated foreign terrorist organization that has targeted U.S. technology and infrastructure.
CyberAv3ngers has previously claimed responsibility for operations targeting U.S. infrastructure, posts the report said, and has issued public warnings that it would strike at perceived threats.
State and federal response so far
WE NEWS contacted Minnesota IT Services (MNIT), the Federal Bureau of Investigation and CISA for comment. According to the report, MNIT and the FBI acknowledged awareness of the groups’ Telegram posts but declined to provide further comment. CISA had not responded to the outlet’s request for comment at the time of publication.
| Agency/Organization | Reported action or status |
|---|---|
| MNIT (Minnesota IT Services) | Aware of posts; declined further comment |
| FBI | Aware of posts; declined further comment |
| CISA | No public response reported at time of story |
| Threat Beat / McCrary Institute | Published analysis attributing claims to APT IRAN and CyberAv3ngers |
Impact on Minnesota communities
The report indicates the incident affected more than 30 water systems across Minnesota. Officials have not yet released a detailed list of affected utilities or specified the nature of the disruptions. Interruptions to water system control networks can range from minor operational anomalies to threats that could endanger public health and service continuity, depending on the tools and access used in an intrusion.
Local water utilities typically work with state IT and public health officials to monitor system integrity and ensure safe drinking water. When suspicious activity is detected, immediate priorities include isolating affected systems, restoring secure operations and notifying potentially impacted residents.
Why attribution and claims matter
Attributing a cyberattack to named groups is a complex process that relies on technical forensics, intelligence sharing and corroboration by multiple authorities. Public claims of responsibility are sometimes used to amplify a group’s message, and they do not, by themselves, prove operational control or state sponsorship.
Federal agencies such as the FBI and CISA typically coordinate with state partners to investigate incidents, issue technical guidance, and, when necessary, notify the public about safety measures or outages.
What residents should know and do
Officials have not issued statewide emergency notices tied to this report, but residents can take routine precautions:
- Follow updates from your local water utility and county public health office for advisories.
- Be prepared for short-term service disruptions and follow boil-water guidance if issued.
- Report unusual water system behavior or communications from utilities to local authorities.
As investigations proceed, MNIT, federal partners and local utilities are expected to share more details about the scope of affected systems and any mitigations undertaken. For now, authorities appear to be balancing public communication with ongoing forensic and intelligence work.
WE NEWS will continue to monitor official briefings and agency statements and will update this story as details emerge.
