This is Managing Editor Ari Weitzman. It’s Tuesday, which used to represent the best day for focused work. Now that I’ve gotten productive on other days, I don’t know what Tuesday means anymore — it’s neither weekend nor mid-week nor beginning of the week, it’s just kind of there. And you know what, days of the week are all weird when you think about it. We have 365 numbered days to track the solar cycle and Roman months to roughly track the lunar cycle. Why do we need another cycle of days named after Norse gods? 

I’ll have to stop there because I have a lot of takes about calendars, and we’ve got to get to these water-system hacks. We also give a look at the history of municipal attacks and a story about an upstanding restaurateur. It’s a 13-minute read on this day of the one-handed god of justice, Týr.

Too busy to read? Push play instead!

Listen to the newsletter every Monday – Friday here.

Quick hits.

1. The House Ethics Committee recommended that Rep. Chuck Edwards (R-NC) be censured after finding “substantial reason” to believe that he made inappropriate sexual advancements toward two female House staffers. (The finding)
2. President Donald Trump said U.S. Attorney Jeanine Pirro “choked” in deciding to drop charges against a man accused of vandalizing the Reflecting Pool in Washington, D.C. Pirro said contractors were responsible for damage to the pool. (The comments)
3. Police arrested a man in connection with the wildfires in Spokane County, Washington, which have destroyed over 700 structures and forced approximately 65,000 people to evacuate. (The arrest)
4. 25 Democratic-led states sued the Trump administration over its new tariffs on 60 U.S. trading partners, alleging the president did not have the authority to impose the duties. (The suit) 
5. Michigan health officials reported two deaths linked to the ongoing cyclospora outbreak in the state, the first confirmed deaths in the U.S. related to the outbreak. (The deaths)

Today’s topic.

Cyberattacks on U.S. water systems. On Thursday, the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert about potential cyber threats to water systems after approximately 36 sites in Minnesota reported cyberattacks. Then, on Saturday, Michigan reported cyberattacks on nine water systems; both states say their water supplies are not actively threatened. Separately, the Federal Bureau of Investigation (FBI) said that attacks have been reported in at least seven states. Federal authorities are investigating the source of the threat, which U.S. investigators believe bears the hallmarks of cyberterrorist groups linked to Iran.

According to Minnesota IT Services, the attacks primarily targeted technology to remotely monitor and control water systems equipment. In one of the most serious cases, attackers shut down the operating controls for the well and water treatment plant in the city of Braham, prompting officials to ask residents to minimize water use; the request was lifted after a few hours. As of Thursday, the state had no active requests for communities to modify their water use.

In Michigan, a spokesman for the Department of Environment, Great Lakes, and Energy said that “a small number of reports from Michigan communities indicat[ed] activity consistent with what federal agencies described,” but all water systems were operating safely. The FBI has not disclosed the other five states where attacks were reported. 

In the wake of the attacks, U.S. officials said the source or sources of the threat are still under investigation, but the incidents resemble past attacks by Iranian hackers. Furthermore, no financial motive has been uncovered, reducing the likelihood that criminal groups were behind the hacks. Braham Mayor Nate George told The New York Times that the state and FBI had relayed to him that they “are pretty sure it’s Iranian actors” but were not ready to say so publicly. 

However, President Donald Trump suggested Minnesota was at fault for the attacks, telling reporters on Friday, “They blame it on Iran. I don’t think so. I think I blame it on Minnesota because they’re grossly incompetent.” Minnesota Gov. Tim Walz responded, “Trump knows exactly who is responsible for this attack,” adding, “This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran.”

Today, we’ll share views from the left and right on the cyberattacks, followed by Managing Editor Ari Weitzman’s take.

In The New York Times, Jen Easterly argued “small towns shouldn’t have to defend America’s water supply from Iran.”

“The attacks, tentatively attributed to Iran, expose a dangerous mismatch at the heart of American cybersecurity: The threat is geopolitical, while the defense is municipal. We are asking small towns — many with no dedicated cybersecurity staff members and little money to spare — to protect essential infrastructure against hackers linked to other nations,” Easterly wrote. “Nation-state hackers do not respect the jurisdictional lines separating federal, state and local responsibility. They search for the most vulnerable way to disrupt American life, and too often they find it in small communities that lack the resources to defend themselves.”

“[Cuts to federal cyberdefense support are] weakening America’s cyberdefenses, and Washington should reverse course… Congress should restore federal support for the multistate information sharing center and commit at least $3 billion in new multiyear funding to the State and Local Cybersecurity Grant Program,” Easterly said. “Cyberattacks will continue, and some will succeed. The task is to ensure that a digital intrusion does not become a public health disaster. In an era of nation-state cyberconflict, the ultimate measure of resilience is brutally simple: When attackers get in, clean water must still come out.”

In MS NOW, Steve Benen said “the Democrats’ criticism is rooted in fact.”

“Even for a president who increasingly treats Democratic-led states as undeserving of federal support and resources, Trump’s eagerness to blame Americans for cyberattacks that appear to have come from Iran was quite bonkers,” Benen wrote. “To hear the president tell it, Minnesota hacked itself, which is every bit as absurd as it sounds… Time will tell whether Trump continues to blame Americans for this, and again questions the existence of the cyberattacks, but as the story unfolds, several Democratic officials are increasingly raising difficult questions about the Republican administration and its record.”

“For example, Minnesota Gov. Tim Walz, whom the president appeared desperate to condemn on Friday, responded to the president by noting the Trump administration’s cybersecurity cuts,” Benen said. “The president who blamed Americans for the cyberattacks is the same president who, just a few months into his second term, fired a series of national security officials… Ten months later, at least seven states are dealing with cyberattacks on domestic water systems. Is the president trying to deflect blame out of petty partisanship, or he is trying to deflect attention away from his own record?”

In Forbes, Steve Weisman asked if the cyberattacks will “be a wakeup call.”

“Water systems have long been particularly attractive targets for our adversaries as these utilities provide essential services but often use outdated industrial control systems with many water systems lacking even basic cybersecurity precautions,” Weisman wrote. “According to the EPA 70% of federally inspected water utilities failed to meet necessary cybersecurity standards… The attack against the Minnesota water facilities occurred only four days after the CISA issued a warning that Iranian backed hackers were targeting critical infrastructure including water systems through attacking Internet connected automated devices used to manage infrastructure systems.”

“There are specific steps that can be taken to reduce the threat of similar attacks,” Weisman said. “Removing internet exposure of industrial control systems; Use of complex passwords… Requiring multi factor authentication for remote access; Continuous vulnerability scanning and monitoring; Replacement of out-of-date equipment and regular software updating of software programs with security patches; Cybersecurity training for personnel; Increased federal funding to small utilities that lack proper cybersecurity personnel. We have been warned for years about this problem and the fixes, many of which are easily achievable, are long overdue.”

In PJ Media, David Manney suggested that the attacks raise “a hard question for every mayor.”

“The FBI says hackers have already reached municipal water controls in at least seven states,” Manney wrote. “Federal inspectors have warned about weak municipal defenses for years. More than 70% of the water systems inspected since September 2023 violated basic federal risk and emergency planning requirements. Inspectors found default passwords, shared staff logins, and accounts that remained active after employees left.”

“Mayors and city councils should demand a current inventory of every internet-connected control device, the date of the last independent assessment, proof that default passwords are gone, and a tested plan for manual operation,” Manney said. “We’re left with a binary choice that every mayor owns now: either the water system has been secured, or the town is waiting for a hacker to discover what local leaders failed to fix.”

The Washington Post editorial board said the breaches “show the vulnerability of U.S. infrastructure.”

“The episode is a frightening reminder of the urgent need to harden critical infrastructure,” the board wrote. “The United States has around 170,000 water and wastewater systems, which are increasingly automated and vulnerable to attack. Such dispersed infrastructure is a strength, in that no single attack can bring down the country’s water sector. But it’s also a weakness, as smaller utilities with aging operational and IT systems often have limited resources or technical capacity to protect themselves. 

“Hopefully, the recent attacks jolt utilities into taking their defenses more seriously. Even a little can go a long way,” the board said. “The [Government Accountability Office] found that many systems lack basic cyber hygiene, such as changing default passwords or updating operating systems. The federal government can also help streamline the overlapping government regulations that hinder utilities’ defenses. As artificial intelligence supercharges the cyber capabilities of nefarious actors, Americans cannot afford operators to be asleep at the pump.”

In National Review, Jim Geraghty wrote about “the cyberattacks that President Trump doesn’t want to acknowledge.”

“Considering the importance of what it does, the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) is surprisingly low-profile,” Geraghty said. “Efforts to hack into critical infrastructure are widespread: in 2024, Check Point Research documented 1,162 cyberattacks on U.S. utilities, a 75 percent year-over-year increase. Given those numbers, perhaps it’s good that we hear about CISA so rarely. But the agency regularly puts out new alerts about foreign cyber threats.”

“Here’s our president on Friday: ‘Today, I just want to mention that we heard in Minnesota there was a cyberattack and they blame it on Iran. I don’t think so. I think — I blame it on Minnesota because they’re grossly incompetent.’... How about the attacks on water systems in those six other states, Mr. President? Do you think ‘the governor’s behind it’ for all of those, too?” Geraghty wrote. “Our critical systems are under attack, and our rambling, erratic, living-in-his-own-world president does not want to acknowledge it. If he did publicly recognize that Iran is trying to harm Americans through their water systems, the public might be rather upset by the latest cancellation of a massive military response against the Iranian regime.”

My take.

Ari Weitzman

Managing Editor

 

• I think the alarm over this story is too high for the actual severity of the threats.
• We’ve known about these vulnerabilities for a long time, and we have the tools to counter them.
• Municipalities still need to plug these holes, but I don’t think our water supply is in danger.

Reminder: This is where we share a personal opinion. If you have feedback, criticism or compliments, leave a comment on the website or reply to this email.

This is one of those stories that starts out sounding scary, then starts to sound silly as you learn more, then ultimately feels like nothing at all. 

Earlier this year, I wrote about Ukraine’s advancements in its war against Russia, saying its quadcopter drones were “terrifying to behold” and provided a glimpse into a potential future of automated warfare that we’re simply not ready for. Reading headlines about these cyberattacks and questions of Iran’s involvement calls unsettling visions to mind: A country we’re currently in a war with half a world away, whose conventional military we are currently dominating, is still managing to hit us at home with a few well placed, low-cost attacks. If the future of war is coming to your kitchen sink, that’s a terrifying prospect.

The actual story is a little less scary, and a lot more asinine.

For years, hackers backed by Iran — with names like Pioneer Kitten, CyberAv3ngers, and Handala Hack Team — have been claiming credit for significant data breaches and performing scary-sounding hacks like this one. Before the U.S. attacked Iran, those efforts mainly focused on Israel, and at first they were mainly bluster. Starting in 2023, Handala Hack began targeting Israeli infrastructure. In 2025, it infiltrated an Israeli alert system to sound emergency alarms in kindergartens and send threatening messages to civilians. It sent messages to 500,000 Israelis claiming to have breached the country’s Iron Dome missile defense system, warning, “You have only a few hours to fix the systems.” But that was a lie designed to make Israelis feel vulnerable.

During the same time period, CyberAv3ngers hacked small digital components called PLCs (programmable logic controllers) made by the Israeli company Unitronics. These internet-connected devices are frequently used in manufacturing processes to automate mechanical tasks or monitor equipment; the Iran-backed group accessed them through vulnerabilities, like not changing the default password, and displayed the message on monitors, “You have been hacked. Down with Israel.” This exact hack hit a water authority in Aliquippa, Pennsylvania, in 2023, causing a monitoring system to be taken offline for a brief period.

Over time, these groups have evolved in their scope of target and the impact of their hacks, but their approach has remained the same. Handala hacked a Michigan medical technology company and FBI Director Kash Patel’s email account earlier this year, leaked a few hundred emails, and warned that they would release more private information. CyberAv3ngers expanded its reach to target PLCs produced not only by Unitronics but also by American, French, and German suppliers. Then, over the past week, a coordinated cyber attack hit 36 municipalities in Minnesota, as well as towns in six other states, causing temporary loss of service in some areas.

Some vulnerabilities are as simple as not changing the device’s default password from “1111” (seriously). They’re also not a surprise; CISA has been aware of them (and warning of them) since 2020. CISA even issued a warning about this general vulnerability — unconfigured PLCs in municipal water systems — in 2023. Then in April of this year, it issued another warning about this exact vulnerability in these exact components. 

It’s not an exaggeration to say that the federal government has been aware of security vulnerabilities in municipal water components for quite some time. It is, however, an exaggeration to say this was some kind of huge danger to the public welfare. In Minnesota, none of the targeted municipalities issued a boil-water advisory — no public contamination, no health hazards. As cybersecurity expert Pierluigi Paganini wrote in Security Affairs, “The actors changed IP addresses and passwords, resulting in loss of monitoring and control functionality. That’s it. Default or weak credentials on internet-exposed hardware, and suddenly operators are locked out of their own systems.”

Obviously, this wasn’t the most confidence-inspiring week for our national logistics. If these municipal systems are this easy to hack, what other vulnerabilities could exist in other systems? This should provide a wake-up call to local governments across the country. But let’s be honest: We’ve been at war with Iran for months, and we’ve been aware of their hacking groups for years; if this is the closest the American public has gotten to even feeling unsafe, then we’re in a pretty good spot. Some group that could be connected to Iran (and almost definitely is) took a crack at one of our largest national cybersecurity vulnerabilities, decentralized across an array of towns, and we pretty much took it in stride. One cybersecurity expert I spoke to said that a simple reboot was likely all that was needed to halt the attack — unless the hackers were extremely sophisticated, which they don’t appear to be, and assuming the systems themselves are even advanced enough for such a hack, which they probably aren’t. All told, I’m actually feeling less concerned about terrorist cyberattacks now than I felt last week.

If I were the president of the United States, I’d take this moment to reassure the public and send back-slaps down the chain of command. My cybersecurity agency, despite its recent cuts, detected this threat well ahead of time and issued amply advanced notice (take that, Chicken Little!). Officials in Minnesota caught the concerted attack and communicated with the public honestly and transparently. Operators at water and wastewater authorities in towns across the country acted quickly and got their services back online with only minimal disruption. It’s not like our entire national infrastructure needs to be completely overhauled — all we have to do is reset some passwords or reassign some port numbers or put remote access behind a VPN to patch this hole. Outwardly, in the midst of an international conflict, I’d project confidence and security. 

Behind the scenes, though, I’d be much more demanding. Why should any American town ever accept employees putting internet-connected devices onto water services without following even the most basic security protocols? In what world is having only 30% of our water systems prepared to respond to an emergency even remotely acceptable? How are state governments not enforcing better guidance about this? And then (truly entering fantasy world here), I’d deny the Pentagon a modest 0.3% of its latest budget request and instead fund a $3 billion information-sharing program at CISA, a direct response to the actions from Iran most likely to impact American citizens at home. 

In the real world, where my office is much less ovoid, President Trump decided to take potshots at Minnesota and its governor, something of a favorite pastime for him. The state isn’t totally blameless here, but Minnesota was one of at least seven states hit, it was the first to report what it experienced, and CISA itself has been warning about a potential Iranian cyberattack exactly like this for years — this didn’t happen because of Gov. Walz’s “gross incompetence.” Slinging jabs at a state led by a guy who ran against him in the last election is technically — and perhaps expectedly — a way for the president to respond, but I can’t say Trump’s message makes me feel any more secure about our government’s ability to address and adapt to these threats moving forward.

Luckily, though, I don’t have to base my feeling of security on messaging. Instead, if I look at how ultimately low-impact this insanely open exploit is turning out to be, I’m left feeling pretty secure. I’ll put it like this: A few months ago, I stopped at a Taco Bell in New Hampshire halfway through a road trip from Vermont to Massachusetts. I used the bathroom while waiting for my food, and when I went to wash my hands, I found the faucet dripping and spraying oddly. After taking a moment to pat myself a little bit drier, I gave the faucet a closer inspection and discovered that someone had fitted a perforated condom up and around the entire fixture. Personally, I feel more terrorized by the possibility of getting hydrologically assaulted by another fast-food-bathroom prophylactic (among other relevant threats) than I do the prospect of my town’s water supply being made unsafe. 

I’m not going to be losing any sleep over CyberAv3ngers; but I am going to continue to keep a few gallons of distilled water handy.

Staff dissent.

Isaac Saul

Executive Editor

 

Unlike Ari, I find these cyberattacks quite worrisome. Hundreds if not thousands of local municipalities being vulnerable to hacks like this seems both obvious and alarming. Of course they don’t have security teams or the resources to respond, and of course that is a huge opportunity for a state actor who wants to sow chaos. If these were actually Iranian hackers, who’s to say this was the maximum damage they could do, and not just a shot across the bow? And what of China, Russia, or other state actors who might be more capable in cyber warfare? Nothing I’ve seen or read gives me confidence these vulnerabilities will be fixed, at scale, any time soon. Given how underfunded and under-resourced so many municipal governments in America are, I have a hard time imagining this becoming a Level 1 priority that gets addressed. The situation, to me, looks more like this: Iran just found an easily exploitable way to upend life for Americans thousands of miles away, and our president responded by blaming domestic political opponents while we lack any clear strategy on how to quickly fund or implement any long-term fixes.

Take the survey: How worried are you by these attacks? Let us know.

Disagree? That’s okay. Our opinion is just one of many. Write in and let us know why, and we’ll consider publishing your feedback.

A deeper look.

Among civilian infrastructure, water systems are particularly vulnerable to cyberattacks because they are decentralized and often rely on older technology — and have been since the dawn of the 21st century. In early 2000, an Australian man successfully hacked into the wastewater system in Maroochy Shire, Queensland, and caused sewage to spill into nearby areas. This is thought to be the world’s first known hacking attack against civilian infrastructure to cause physical damage.

There were several attempted attacks against U.S. water systems, but the first to cause physical damage occurred in 2007, when a California man was accused of installing unauthorized software on a canal system’s computer typically used to divert water from the Sacramento River. The man had been an employee of the canal system before carrying out the attack, which caused over $5,000 in damage to the computer. 

Since then, several more cyberattacks have been carried out, often in the form of either ransomware or remote access. In 2021, WSSC Water in Maryland experienced a ransomware attack in which cybercriminals gained access to internal files. In 2024, a hack against American Water — the largest publicly traded water utility in the U.S. — forced it to shut down key systems, including customer billing, until the exploit was under control. No group took responsibility for either attack, and water treatment was not affected.

The extras.

• One year ago today we covered President Trump firing the commissioner of labor statistics. 
• The most clicked link in our last regular newsletter was Ari’s interview with climate scientist Zeke Hausfather on the Canadian wildfires.
• Nothing to do with politics: The Zac Brown Band had an incredible surprise for fans at its Sunday show in Boston.
• Our last survey: 1,978 readers responded to our survey on the U.S.-brokered peace plan for Israel and Gaza, with 66% saying they approve of the board’s plan but are pessimistic about peace. “The hatred is too deeply ingrained for either side to commit to the peace plan,” one respondent said. “Just like the Iran deal, I will believe it when I see it,” said another.

We asked a similar question in January 2026, and these were the results:

Have a nice day.

Sak Yiengjuntuek bought a restaurant space in April 2025, and it was a bit of a fixer-upper. A fire at a business next door had knocked out power to the restaurant, forcing it to close for several months. While cleaning in preparation for the reopening, Yiengjuntuek came across an old cabinet containing $12,000, some of it hidden inside a sunglasses case. He realized the cabinet belonged to the previous owner and set off to track him down. After several tries to get in touch, he finally reached the man and returned the money. “I feel like this was the right thing to do,” Yiengjuntuek said. “Honesty, integrity, is very important in life.” WLBT3 has the story.