Seven States Report Water-System Intrusions and the President Has Blamed Minnesota’s Governor

Minnesota IT Services says a “coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems” on 26 and 27 July. On 30 July the FBI, EPA and CISA issued a joint warning that attackers were targeting internet-exposed industrial controllers at water and wastewater utilities, with CISA’s alert describing threat actors modifying passwords “to lock out operators.” On 31 July the New York Times reported that US and state officials believed Iranian hackers were likely responsible; Fox News, summarising the piece, said three state officials briefed on the investigation cited the tradecraft and the absence of a ransom demand, with the caveat that the assessment could change. NBC News, the same day, attributed the “hallmarks of Iran-backed hackers” line to a single senior law enforcement official. ABC had “multiple US officials” saying the attacks may have been linked to Iran. All of it anonymous.

Then the President intervened. At a televised Cabinet meeting at Camp David on 31 July, Trump said, per CBS News: “I think that Minnesota is behind it. You know who’s behind it? Minnesota. Because they’re grossly incompetent. I think the governor’s behind it. I don’t think there was an Iranian cyberattack.” He added: “They like to say, ‘Oh, it was Iran.' Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota.” Michigan reported attacks on its water systems on 1 August, with a state official saying all systems were operating “safely.” By 2 August CBS reported the FBI had logged incidents in at least seven states, unnamed, with some utilities switching to manual operations. CBS noted that neither Minnesota nor the federal government has publicly attributed the activity to any actor, and that official confirmation “can take weeks or months.”

Assessment: The line nobody downstream is carrying is CBS’s: investigators are also probing whether the actor tried to appear Iran-based, to stir the pot during an active US–Iran confrontation. That hypothesis and the presidential denial point in the same direction while coming from opposite motives, and between them they make an on-the-record attribution politically expensive for CISA and the FBI. Watch for silence rather than reversal — a stalled attribution after this kind of intervention is the reportable event. Two other gaps matter: which five unnamed states, and whether any utility lost control rather than monitoring. Defacing an HMI display and moving a valve are not the same incident.