A coordinated cyberattack struck water and wastewater utilities in at least seven states over the past week, targeting the industrial control systems that operate treatment plants, wells and water towers — and triggering a public dispute between federal cybersecurity officials and President Donald Trump over who, or what, is to blame.
The attacks began the weekend of July 26-27 in Minnesota, where hackers targeted operational technology — specifically remotely accessible programmable logic controllers, or PLCs — at more than 30 community water and wastewater systems.
The most visible impact hit Braham, a city of roughly 1,700 people north of Minneapolis, where attackers disabled the computerized controls running the city's well and treatment plant. Public works crews restored the system within roughly two hours; residents were asked to minimize water use in the meantime, though officials said drinking water was never compromised.
Three other Minnesota cities — Plymouth, South St. Paul and Maple Plain — confirmed similar activity. Plymouth's IT division disconnected cellular-connected equipment at two water towers and several wastewater lift stations to stop the intrusion. State officials said none of Minnesota's water supply was compromised and no ransom demand was made.
Michigan confirmed cyber activity consistent with the same campaign at nine water systems after receiving a federal alert. "All systems continued to operate safely, issues were addressed by local operators, and there are no known impacts that posed a public health concern," said Dale George of the Michigan Department of Environment, Great Lakes, and Energy.
An FBI and EPA advisory issued Thursday said water and wastewater utilities in at least seven states have reported incidents since Monday, some of which degraded water operations. Officials have not publicly named all of the affected states.
Nick Anderson, acting director of the Cybersecurity and Infrastructure Security Agency, confirmed the agency is "observing a significant increase in cyber threat actors targeting programmable logic controllers at water utilities," and urged infrastructure operators to remove publicly exposed PLCs and other operational technology from the internet.
U.S. officials have treated Iran-affiliated actors as the leading preliminary suspect, consistent with prior CISA warnings about Iranian campaigns targeting the same kind of industrial controllers common at smaller municipal utilities. A leaked WaterISAC memo reportedly linked the Minnesota incidents to techniques previously attributed to Iran-linked groups. Investigators have also examined whether the activity could be designed to look Iranian in order to inflame tensions, though officials have called that scenario unlikely. Formal attribution remains unresolved, and the FBI has not publicly named a culprit.
President Trump broke from that assessment Friday, telling reporters at a Cabinet meeting at Camp David that he does not believe Iran was involved. "We heard in Minnesota there was a cyberattack, and they blame it on Iran. I don't think so," Trump said. "I think I blame it on Minnesota because they're grossly incompetent." He went on to call Minnesota Gov. Tim Walz "the corrupt governor of Minnesota," adding, "Iran should be so lucky. Iran's got bigger problems than worrying about Minnesota."
Walz pushed back on social media, writing that Trump "knows exactly who is responsible for this attack, and knows that other states were hit too," and called it a preview of modern warfare with Iran. Walz separately argued that federal budget cuts had left water systems more exposed to attack.
Cybersecurity researchers say the scale of the campaign is unusual. Attackers appear focused on internet-facing industrial control systems common at smaller municipal utilities, with the apparent goal of disrupting system pressure — a scenario that carries theoretical contamination risk, though rapid local response and the inherent resilience of water infrastructure limited real-world impact in every confirmed case so far. Small municipalities continue to cite the cost of upgrading aging IT and OT systems as a persistent vulnerability.
Investigators in Minnesota and at the federal level say they are continuing to assess the full scope of the campaign, track further state confirmations, and watch for updated indicators of compromise as the investigation continues.
Sources:
Tenable / CISA Advisory AA26-097A: https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know
CBS News: https://www.cbsnews.com/news/us-investigating-iran-cyberattack-minnesota-water-systems/
The Hill: https://thehill.com/homenews/administration/6002858-trump-blames-minnesota-for-cyberattacks-iran/
Washington Post: https://www.washingtonpost.com/politics/2026/07/31/trump-blames-minnesota-not-iran-cyberattack-water-systems/