The FBI has confirmed that cyberattacks on water utilities have now affected at least seven US states, expanding the known scope beyond more than 30 targets in Minnesota. Officials believe Iranian-affiliated hackers are the leading suspects, making the campaign one of the broadest known attacks on US industrial control systems and raising concerns about disruption to essential water services.

The FBI did not name the affected states or detail the scale of damage, but said it and the Environmental Protection Agency were supporting utilities. The Cybersecurity and Infrastructure Security Agency said some attacks disabled digital controls and led to boil-water notices, suggesting possible contamination risks; utilities were urged to take internet-connected programmable logic controllers offline, strengthen passwords and restrict access to authorised devices.