FBI investigating possible ties between Iran and cyberattacks on Minnesota water systems
Measured from 31 Jul 2026 (event start), not the 31 Jul 2026 announcement
Treasuries moved -5.7%, a statistically significant reaction beyond the overall market. This is a provisional result; the full measurement window is not yet complete.
TLT · down
What Happened
Over 30 water systems in Minnesota were targeted by cyberattacks, with FBI investigating possible Iranian state actor involvement. The attacks occurred amid elevated US-Iran military tensions following recent US airstrikes on Iranian positions and IRGC strikes on US forces. Officials warned that Iranian hackers have been specifically focused on critical infrastructure systems. The attacks represent a significant escalation in cyber warfare beyond military targets into civilian critical infrastructure. Immediate consequences include disrupted water treatment operations, potential contamination risks, and emergency response mobilization across multiple jurisdictions.
Represents first direct Iranian cyber strike on US civilian critical infrastructure during active conflict, establishing new escalation threshold with direct implications for cost of capital and risk pricing across infrastructure and tech sectors.
Attacks occurred during the week of July 28-31, 2026, during active US-Iran military escalation
Attacks occurred earlier in the week of July 28-31, with FBI investigation announced by July 31. The timing is recent and confirmed by multiple sources including NBC News.
Read how dates work →Partial reaction shown. Significance flags are marked provisional and may change as more price data accumulates.
How To Read This
Each sector below is a basket of named stocks. The percentage shown is the move beyond the overall market (S&P 500) , what event studies call the . A move only counts as when it sits clearly outside that basket's normal weekly swings.
How Much Sectors Moved
Path over time. Click a sector in the legend to toggle it. Dashed lines mark key moments.
Treasuries moved most at -5.7% against the market, the direction you would expect from a cyberattack. 1 of 4 sectors cleared the significance threshold: Treasuries. The rest sit inside their normal weekly range and should not be over-read.
Volatility
Volatility measures how erratic prices became, a separate signal from the direction of the move.
Market fear eased
- Gold22% → 31%1.4x more volatile after
- Treasuries9% → 9%volatility roughly unchanged
- Defense33% → 5%6.7x calmer after
- Broad market12% → 13%volatility roughly unchanged
The VIX fell 9.0 percent across the window, a mild move. Read this as the market's demand for protection, not the direction of any single sector.
A ratio above 1.00 means the sector's daily-price swings widened after the event. Gold became the most erratic at 1.43×, and 1 of 4 sectors traded meaningfully wider than they did before. Volatility is a separate signal from direction: a sector can end flat and still have traded wildly along the way.
Phases
| Sector | Peak Move | Peak Day | Reverted By |
|---|---|---|---|
| Gold | -3.6% | Day 2 | Day 3 |
| Treasuries | -4.7% | Day 5 | Still elevated |
| Defense | +2.9% | Day -4 | Day -1 |
| Broad market | +0.1% | Day 0 | Day 1 |
The reaction peaked around day 1 on average. 3 of 4 sectors reverted inside the window, 1 were still elevated at the close. A reaction that reverts is a shock priced in; one that stays is a re-rating.
Historical Precedents
Companies Most Affected
Measured 10 days after the event. Reaction still developing; the full window is not yet complete.
This tool informs your decision. It does not give investment advice.