Investigators are probing whether Iranian hackers are behind the malicious cyber activity this week that targeted water systems in seven states, including Minnesota. If they are found to be the culprits, it would not be the first time Iranian actors have been linked to cyberattacks against the U.S.
For more than a decade, Iranian-linked operators have repeatedly hacked accessible American targets. They scan for widespread vulnerabilities and aim to create disruption, intimidate, gain publicity and undermine trust in the American government.
But official confirmation can take weeks or months as investigators collect technical evidence. Investigators are also looking into whether the actor could have attempted to appear Iran-based as a way of stirring the pot amid the U.S. war with Iran.
Iran has long denied any involvement in cyberattacks.
Here are some of the high-profile Iranian-linked cyberattacks in the U.S.:
2011-2013: Dozens of U.S. banks
Seven Iranians working for companies connected to the Iranian government and Islamic Revolutionary Guard Corps were charged a decade ago with distributed denial-of-service, or DDOS, attacks against 46 financial institutions between 2011 and 2013.
The Justice Department said that bank websites were disabled, which meant customers could not access their accounts online. Collectively, the attacks cost customers and the victim banks tens of millions of dollars in remediation costs.
2013: New York dam
In the same indictment accusing Iranian hackers of attacking banks, one defendant was charged with accessing the control system for the Bowman Avenue Dam in Rye, New York. While the cyber actor was able to view operational information, the sluice gate, which is used to control water levels, was disconnected at the time for maintenance.
2014: Las Vegas Sands
In 2014, the Las Vegas Sands casino company’s hard drives were wiped, its corporate network was damaged and its hotel websites were vandalized with condemnations of CEO Sheldon Adelson’s comments about using nuclear weapons on Iran.
The casino company also said the hackers had stolen the personal information of tens of thousands of customers, including their Social Security and driver’s license numbers.
Then-Director of National Intelligence James Clapper publicly blamed Iran for the hack. In a congressional hearing on worldwide threats, he said it marked the first time “destructive cyberattacks [were] carried out on U.S. soil by nation-state entities.”
2016-2021: Federal agencies and defense contractors
A group of Iranian hackers allegedly targeted the U.S. State Department, Treasury Department and multiple defense contractors with access to classified information, the Justice Department said in 2024. An accounting firm and a hospitality company were also hit during the hacking campaign, which began by 2016 and ran until at least 2021, a federal indictment alleges.
The defendants worked for a company that claimed to offer cybersecurity services, according to the Justice Department. One of them was accused of also working for the electronic warfare division of Iran’s Islamic Revolutionary Guard Corps, or IRGC.
2017-2024: Ransomware and extortion
The FBI and Cybersecurity and Infrastructure Security Agency (CISA) warned that from 2017 to 2024, a group of Iranian government-associated actors — known by names like Pioneer Kitten — had compromised schools, municipal governments, healthcare organizations and financial institutions.
In some cases, they maintained access to the compromised systems and transferred them to ransomware affiliates, which then extorted the victims. Federal authorities said the group’s ransomware likely wasn’t sanctioned by the Iranian government, but the attackers also targeted “U.S. defense sector networks” and other entities that aligned with the interests of Iran.
2019-2021: John Bolton’s email
At some point between 2019 and 2021, an actor believed to be linked to Iran hacked an email account belonging to President Trump’s former National Security Advisor John Bolton, federal prosecutors said in an indictment last year accusing Bolton of mishandling classified records.
The indictment said Bolton — a former ambassador to the United Nations and longtime Iran hawk — received a menacing email about the hack, warning: “I do not think you would be interested in the FBI being aware of the leaked content of John’s email.”
2020: Attempted election meddling
Shortly before the 2020 election, voters in Florida and several other states received emails claiming to be from the far-right Proud Boys, warning them to “vote for Trump or else!” Intelligence officials later said Iran appeared to be behind the emails.
The following year, federal prosecutors accused two Iranian hackers and several other co-conspirators of exploiting a “misconfigured computer system” to download “confidential” information on more than 100,000 voters in an unspecified state without authorization. They also attempted to compromise several other states’ websites, the Justice Department said.
The conspirators then allegedly sent out threatening emails to tens of thousands of registered Democrats — including some of the voters whose information was successfully taken from a state website — claiming to be from the Proud Boys.
The conspirators allegedly targeted Republican officials, too, sending them a staged video that claimed to show individuals hacking into state voter websites. The hackers were also accused of intruding into an unnamed media company’s website.
The U.S. intelligence community assessed shortly after the 2020 election that Iran sought to damage the Trump campaign and tried to “undermine public confidence,” but did not try to “manipulate or attack any election infrastructure.”
Separately, the FBI blamed Iranian actors for setting up a website called “Enemies of the People” that displayed death threats against U.S. election officials in late 2020.
2021: Boston Children’s Hospital
The FBI helped thwart an Iranian-linked 2021 attack on Boston Children’s Hospital, former FBI Director Christopher Wray said the following year, calling it “one of the most despicable cyberattacks I’ve seen.”
CISA said in 2021 that Iranian-sponsored actors targeted an unnamed “U.S.-based hospital specializing in healthcare for children” and a municipal government.
2023-2024: CyberAv3ngers’ targeting of water systems
Calling itself the CyberAv3ngers, a group affiliated with the IRGC exploited devices called programmable logic controllers, or PLCs, which are commonly used to remotely monitor and control machinery, CISA said in 2023 and 2024. The same types of devices were targeted in this week’s apparent cyberattacks on Minnesota water systems.
The targets included water and wastewater systems in the U.S. and Israel, and users of PLCs in some other sectors. In some cases, the targeted devices were made by the Israeli company Unitronics and either had no password or a default password. After a PLC was compromised, according to CISA, it would display the message: “You have been hacked, down with Israel.”
The hackers succeeded in shutting down water pumping equipment in Aliquippa, Pennsylvania, in 2023.
2024: Presidential campaign hack-and-leak operation
Three Iranian nationals and IRGC employees were accused by the Justice Department of hacking into the accounts of current and former U.S. officials, members of the media and political campaigns.
Prosecutors said they aimed to stoke discord and erode confidence in the electoral process, as well as obtain information about U.S. officials that could be used to advance IRGC efforts to avenge the 2020 killing of their commander, Qasem Soleimani.
The Iranians successfully gained access to personal accounts belonging to people associated with a presidential campaign. While the Justice Department didn’t identify the candidate, it was reported by CBS News and others to be the Trump campaign.
The Trump campaign said publicly it was hacked by potential Iranian attackers who stole and distributed its sensitive internal documents. The FBI also investigated possible Iranian targeting of the Biden-Harris campaign’s emails.
2026: Medical tech company
The Justice Department seized four websites it says were used by Iranian state-linked groups to post hacked information and take credit for cyberattacks. One of those groups, Handala, appeared to take credit for a March attack on medical technology company Stryker.
2026: Kash Patel’s email
Iranian-linked cybercriminals accessed FBI Director Kash Patel’s personal email account, CBS News has previously reported, in a hack the Handala group took responsibility for.
