Thirty Minnesota Water Systems Were Breached Nine Days Ago and No Named Official Has Said Iran

Minnesota IT Services said at least 30 municipal water and wastewater facilities were targeted on 26 and 27 July and that it “immediately activated the state’s cybersecurity incident response capabilities,” per TIME’s 2 August account. On 30 July the FBI and EPA issued a joint statement warning that “malicious cyber actors” have been remotely tampering with water systems by reaching internet-connected controls and changing administrator passwords; CBS News reported that CISA joined the same-day warning and that the targeting was of internet-exposed industrial controllers. Over the weekend of 1–2 August Michigan reported attacks on nine of its water systems, and Rapid City, South Dakota confirmed an incident. The FBI’s own count is incidents in “at least seven states” — a floor, not a total. Only three jurisdictions are public.

The attribution is where the reporting thins out. NBC News reported on 4 August that the intrusions had “hallmarks of Iranian meddling, according to a law enforcement official” — one unnamed source, and the load-bearing sentence in most of the week’s coverage. CBS News reported that its sources cautioned they had not definitively attributed the attack and that their assessment could change, and, more pointedly, that investigators are probing whether the actor “could have attempted to appear Iran-based as a way of stirring the pot” during the US confrontation with Iran. Tenable’s 4 August write-up kept “cyberattack” in quotation marks and said attribution “remains pending a federal investigation.” Fox News published a headline stating investigators believe Iranian hackers are likely responsible; that is aggregation of the same single source, not a second confirmation.

Governor Tim Walz of Minnesota told NBC News, in a statement the network quoted only “in part”: “Trump knows exactly who is responsible for this attack, and knows that other states were hit too. This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran.” That is a claim about what the administration knows, made by an opposition governor, not a disclosure of what has been established. No named FBI, CISA or EPA official in the material available has attributed the intrusions to Iran or to any state.

Assessment: Three actors have an incentive to settle attribution before the evidence does: an administration selling a Hormuz de-escalation it alone describes, a governor with a war-planning argument to make, and hacktivist channels that inflate. The historical baseline argues for patience. Dragos assessed Cyber Av3ngers' 2023 claims against Israel Railway, an Israeli power grid and the city of Yavne as false, and Sophos in March judged most emerging pro-Iran groups reliant on “unsophisticated tactics, broad and embellished claims, and narrative amplification.” The test is not another anonymous “hallmarks” line. It is a named official, or technical indicators from Dragos, Claroty or Mandiant that either match AA26-097A or break from it.