President Trump dismissed preliminary reports suggesting Iran was behind cyber-attacks that disrupted dozens of community water systems on 26–27 July, instead blaming Minnesota and Governor Tim Walz. Federal agencies — including CISA, the FBI and the EPA — warn that attackers targeted programmable logic controllers (PLCs), changed IP addresses and passwords, and forced some systems to operate manually. Investigators say attribution to Iran is still preliminary while they continue to collect and analyze data.
Trump Blames Minnesota, Not Iran, After Coordinated Cyberattacks Disrupt Water Systems
[PA]
President Donald Trump on Friday rejected media reports and preliminary investigator suggestions that Iran may have been behind a series of cyber-attacks on U.S. water systems, instead blaming the state of Minnesota and its governor for the incidents.
What Happened
Minnesota's state IT agency reported that dozens of community water systems experienced a "coordinated cyber-attack" on 26 and 27 July. Attackers remotely accessed equipment that monitors and controls water systems — including programmable logic controllers (PLCs) — and altered settings such as IP addresses and passwords, which in some cases forced operators to run systems manually or issue boil-water notices.
Investigations and Attribution
U.S. investigators have been examining whether Iran may have been involved, but officials cautioned that any attribution remains preliminary and could change as more data is collected. The Cybersecurity and Infrastructure Security Agency (CISA) would not confirm media reports linking the Minnesota incidents directly to Iranian state actors.
Officials' Reactions
At a cabinet meeting, Mr. Trump said: "They blamed it on Iran. I don't think so. I think I blame it on Minnesota because they're grossly incompetent," and called Minnesota's Democratic Governor Tim Walz "corrupt." He added, in an apparent reference to tensions with Tehran, "Iran should be so lucky. Iran's got bigger problems than worrying about Minnesota."
Governor Walz responded: "Trump knows exactly who is responsible for this attack, and knows that other states were hit too."
Federal Warnings and Scope
The FBI and the Environmental Protection Agency (EPA) issued a joint public service announcement saying water and wastewater entities in at least seven states reported similar malicious activity, with some incidents causing "degraded water options" for affected communities. Their bulletin noted: "After remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality."
CISA has warned of a significant increase in hostile actors targeting water and wastewater systems and previously published advisories about attacks on internet-connected operational devices, including PLCs made by Rockwell Automation and other manufacturers.
State Response
John Israel, Minnesota's chief information security officer, said the state had identified "malicious activity involving a system's technology" but clarified that not all communities experienced service disruptions. He added that Minnesota has shared relevant information with federal partners, who are "evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor."
The report also quoted Governor Walz accusing the now-defunct Department of Government Efficiency (Doge) of having "gutted" CISA in prior years, leaving the nation more exposed to cyber risk — a claim Walz used to underscore the need for stronger federal cyber defenses.
Why It Matters
The United States operates roughly 152,000 public drinking-water systems and more than 16,000 wastewater-treatment systems, many of which remain vulnerable to cyber threats. The recent incidents highlight risks to critical infrastructure and the challenges investigators face in attributing cross-border cyber intrusions amid broader geopolitical tensions.
Help us improve.
