By AJ Vicens
July 28 (Reuters) - A "coordinated cyberattack" targeted more than 30 community water systems in the U.S. state of Minnesota on July 26 and July 27, the state's IT agency said in a statement.
The agency, Minnesota IT Services, said it was not aware of any active requests from Minnesota cities to have residents modify their drinking water usage, according to the statement, which comes a day after local media reported that four Minnesota cities issued notices about cyberattacks on their networks.
The attacks are similar to a wave of cyber intrusions against U.S. water infrastructure that officials have in the past attributed to Iranian-affiliated hackers, raising concerns about the vulnerability of local utilities that serve millions of people.
Emily Zimmer, a spokesperson for the agency, told Reuters in an email that while the investigation remains ongoing, "the timing, methods of access, and targeted infrastructure share characteristics with other coordinated cyber incidents our federal partners have observed involving critical infrastructure."
Zimmer said the agency could not yet discuss formal attribution or specifics of the incidents. Zimmer said the agency used the term "attack" to describe the situation "because investigators identified unauthorized access with malicious intent directed at these systems."
The FBI and the Cybersecurity and Infrastructure Security Agency did not immediately respond to requests for comment.
While it is not yet clear who is responsible for the attacks, Iranian-linked hackers have for years targeted U.S. water systems to varying levels of success.
An April 7 CISA advisory warned that Iranian-affiliated hackers were attacking internet-facing programmable logic controlers, computer devices used to interact with machinery and other critical infrastructure networks, manufactured by Rockwell Automation.
A July 22 update to the advisory expanded the scope of the targeting to include devices manufactured by Schneider Electric, Siemens and potentially other manufacturers.
"CISA’s updated reporting shows a worrying expansion in Iran-linked critical infrastructure targeting focused on the United States," Joe Slowik, director of threat research and cyber engineering at cybersecurity firm Dataminr, said in a July 27 blog posted to the company's website.
While the initial advisory was concerning enough, Slowik said, "Extending this activity to encompass additional equipment lines and pairing this with process manipulation and safety degradation makes matters more concerning as it enables various physical impact scenarios."
(Reporting by AJ Vicens in Detroit, additional reporting by Raphael Satter in Washington; Editing by Sanjeev Miglani)
