The NY Times claims that Idaho National Laboratory at Idaho Falls used their security testing of the Siemens PLC systems to find vulnerabilities to be used in the Stuxnet attack. Apparently Siemens thought this testing was done in order to secure industrial systems. In any case, it is easy to confirm that Siemens and INL did joint security testing in 2008, see this slide:
Image copyright Idaho National Laboratory & Siemens
The target of the attack was to modify the operation of high-frequency power drives made by Vacon and Fararo Paya. These drives were controlling the centrifuges that were enriching uranium.
Stuxnet specifically targets a grid of 984 converters.
Curiously, when international inspectors visited Natanz enrichment facility in late 2009, they found that the Iranians had taken out of service a total of exactly 984 machines.
While Stuxnet is doing malicious modifications to the system, it uses a man-in-the-middle attack to fool the operators into thinking everything is normal.
Iranian President Mahmoud Ahmadinejad confirmed in November 2010 that a cyber attack had indeed caused problems with their centrifuges.
Another leaked embassy cable would indicate that there would other, unknown enrichment plants in addition to Natanz. Attacking such unknown targets with cyber sabotage makes much more sense than, say, trying to bomb them. A worm will find even the facilities that you do not know about.
There is a real fear that we will eventually see modified copies of Stuxnet.
While modifying Stuxnet is obviously not easy, it is easier than creating the same functionality from scratch.
Finding a copy of Stuxnet is not hard at all as you can see from this forum posting we found: