Trump Blames Minnesota, Not Iran, for Cyberattack That Hit Water Systems in 7 States
A coordinated cyberattack disrupted water and wastewater systems across more than 30 Minnesota communities in late July, forcing some utilities onto manual operations and triggering boil-water notices. Federal officials say the attack, which also touched systems in six other states, may be linked to Iran — but President Trump says he doesn’t buy it, instead pointing the finger at Minnesota’s state government.
What Happened to the Water Systems
The breach began the night of Sunday, July 26, and continued into Monday, July 27, when hackers targeted the operating technology used by more than 30 water systems across Minnesota, according to state officials. A memo from the Minnesota Bureau of Criminal Apprehension, obtained by CNN, said the likely goal of the intrusion was to cause a loss of system pressure and potentially compromise the water supply.
CBS News reported that the attackers primarily targeted programmable logic controllers, or PLCs — the industrial devices used to remotely monitor and control equipment like pumps and valves. In some cases, federal authorities reported a loss of monitoring and control functionality at affected sites, which led to pressure loss and, in at least one instance, flooding. Despite the disruption, officials have been clear on one point: Mike Ernster, a spokesperson for the Minnesota Department of Public Safety, told CBS News that no water supply has been reported compromised as a result of the attack.
The breach wasn’t limited to Minnesota. CBS News later confirmed that federal investigators were looking into whether Iran was behind cyberattacks on water systems in seven states total, including Michigan, and NBC News reported that municipal water systems in seven states were targeted over the course of the week.
The Federal Response
The scale of the intrusion prompted a joint warning Thursday, July 30, from the Cybersecurity and Infrastructure Security Agency, the FBI, and the Environmental Protection Agency. CISA’s acting director, Nick Anderson, said the agency was observing a significant increase in threat actors targeting PLCs specifically within the water and wastewater sector, and urged utilities to disconnect exposed controllers from the internet immediately or, if remote access is required, route it through a VPN or secure gateway.
The FBI confirmed it was aware of the intrusions but stopped short of formally assigning responsibility. That caution reflects a broader reality described by TJ Sayers, senior director of threat intelligence at the nonprofit Center for Internet Security, who told StateScoop the Minnesota attacks hadn’t yet been formally attributed to any specific actor as of late July.
Still, the timing raised immediate suspicion. The warning came just days after CISA, the FBI, and other agencies had already cautioned — in a separate advisory issued July 22 — that Iran-linked hackers were actively trying to breach internet-connected devices used to manage U.S. infrastructure, part of a broader pattern of Tehran-linked cyber activity amid the escalating military conflict between Washington and Iran. U.S. intelligence agencies have also previously noted that Iran attempted to target American water systems as far back as 2023.
Trump Pushes Back on the Iran Theory
Even as his own administration’s investigators examined a possible Tehran connection, Trump rejected the idea outright during a Cabinet meeting Friday, July 31, at Camp David. Asked directly whether he could rule out Iranian involvement, Trump said no, he didn’t think Iran was behind it, and suggested Minnesota was responsible instead.
Trump went further, calling Minnesota’s government “grossly incompetent” and specifically criticizing Democratic Gov. Tim Walz, whom he referred to as corrupt. He also dismissed the idea that Iran would have reason to target Minnesota specifically, saying the country has bigger problems right now than the state’s water systems.
Walz responded on social media, saying Trump knows who’s actually responsible for the attack and knows other states were affected too, without further elaborating on the state’s own findings.
Trump’s remarks came amid an active U.S. military and cyber conflict with Iran, which has included tension over the Strait of Hormuz and reports of Iranian ballistic missile attacks intercepted by U.S. forces — a backdrop that makes his public rejection of the Iran theory notable, since it runs counter to the working assumption of his own administration’s cybersecurity and law enforcement agencies.
Why This Matters Beyond Minnesota
Security researchers say the incident reflects a structural vulnerability across the country, not just one state’s problem. The U.S. has somewhere between 150,000 and 170,000 separate water utility systems, according to StateScoop reporting, and many of them — particularly smaller, rural systems — have limited resources to defend against sophisticated cyber intrusions.
Sayers also cautioned that offensive cyber activity targeting infrastructure is likely to accelerate in the near term as AI tools make it easier to develop and deploy these kinds of attacks, though he noted that, of the numerous nation-state attacks on U.S. water facilities documented in recent years, none has resulted in a confirmed major public health impact.
Separately, the Department of Justice has pursued criminal cases tied to earlier, unrelated attempts to sabotage U.S. water infrastructure, including an indictment against a suspect extradited to the U.S. for alleged work with Russia-linked hacking groups — a reminder that Iran isn’t the only nation-state actor federal officials have flagged as a persistent threat to water infrastructure.
FAQ
Was Minnesota’s drinking water contaminated? No. State officials say no water supply has been reported compromised, though some utilities issued boil-water notices and switched to manual operations as a precaution.
How many states were affected by the cyberattack? Federal officials are investigating whether the same actors were behind cyberattacks on water systems in seven states, including Minnesota and Michigan.
Has the attack been officially attributed to Iran? No formal attribution had been made as of early August 2026. Federal investigators, including the FBI and CISA, were examining a possible Iran connection, but a cybersecurity researcher noted the attacks hadn’t yet been tied to a specific actor.
Why does President Trump disagree with his own administration’s investigators? Trump said at a July 31 Cabinet meeting that he blames Minnesota’s state government for the cyberattack rather than Iran, despite federal agencies within his own administration actively investigating a possible Iranian link.
What should water utilities do to protect themselves? CISA has urged water and wastewater utilities to remove internet-exposed programmable logic controllers from public access and to use a VPN or secure gateway device if remote access is necessary.
Conclusion
The Minnesota water systems attack has become notable for two separate reasons: it’s one of the most serious cyberattacks on U.S. water infrastructure in years, and it has produced a rare public split between the president and his own administration’s cybersecurity agencies over who’s responsible. With CISA, the FBI, and the EPA still working to secure affected systems and formal attribution still pending, the investigation is likely to remain a flashpoint — both as a cybersecurity story and as a political one — in the days ahead.
Sources: CNN, CBS News, NBC News, ABC News, Newsweek, The Washington Post, StateScoop, Star Tribune (reporting dated July 30-August 1, 2026).