Trump Says Minnesota Did Its Own Cyberattack While Iran Hits 7 States' Water

What Is Actually Happening to Your Water

The U.S. Cybersecurity and Infrastructure Security Agency issued an advisory Thursday warning that hackers are "targeting water entities of all sizes" and recommending that facilities physically unplug vulnerable controllers from the internet. That sentence alone should ruin your morning. The agency said the attacks have "resulted in boil water notices and sustained manual operations" across the country.

The New York Times broke the story of Iran's suspected involvement, and by Thursday night the FBI and EPA had confirmed in a public advisory that since Monday, at least seven states had reported incidents, with some of that activity actively degrading water operations. Officials have declined to name all the affected states, but a Michigan government spokesman confirmed his state was hit, telling reporters that communities there showed "activity consistent with what federal agencies described."

The specific targets are internet-connected industrial control systems, the kind used to monitor and adjust chemical treatment levels, water pressure, and water quality. No water supply has been confirmed as altered or made unsafe to drink, but that is a very thin margin of comfort when the systems keeping it that way are under active foreign attack.

Iran Escalated, Experts Say, Because of Course It Did

The U.S. and Israel launched a war against Iran five months ago, in February. Since then, according to the Times, Tehran has significantly stepped up cyberattacks against American, Israeli, and Middle Eastern targets. The intrusions into water systems represent what cybersecurity experts are calling a meaningful escalation.

Alex Orleans, formerly a U.S. government cybersecurity contractor and now chief of threat intelligence at Sublime Security, told the Times flatly: "What's unprecedented here is that we're seeing direct, tangible effects to live industrial control systems inside U.S. critical infrastructure." That is a sentence written by someone who has spent years worrying about exactly this scenario finally watching it happen in real time.

Orleans added that Iran appears to be operating opportunistically, casting the widest possible net rather than picking specific cities. A memo obtained by Wired magazine from an industry group that shares cyberthreat data among water utilities said the attack patterns aligned with Iran-affiliated hacking activity. Translation: this is not a coincidence, it is not a criminal ransomware crew looking for a payday, and the people tracking these things are not confused about where it is coming from.

Minnesota: The State That Noticed and Got Blamed For It

Here is how Minnesota ends up at the center of this story. It was among the first states to publicly report the surge in malicious hacking activity, which prompted other states to start checking their own systems. Being alert and transparent about a national security threat is, in a functioning republic, a good thing to do.

Trump used it as an attack vector. Asked directly about Iran's possible involvement on Friday, the president said, "I think Minnesota is behind it. I don't think there was an Iranian cyberattack." His own intelligence agencies, according to officials familiar with the assessment who spoke to the Times, believe Iranian involvement is highly likely. After Trump spoke, federal officials privately confirmed that Iran remains the top suspect.

Governor Tim Walz, whose name you might remember from the 2024 presidential race, pushed back immediately. "This is what modern warfare looks like," he wrote on social media. Nate George, the Republican mayor of Braham, a small city north of Minneapolis that was directly affected, was more careful with his words but no less clear. He told the Times that local and federal officials are "pretty sure it's Iranian actors" but remain hesitant to say so publicly. He allowed that Trump was "entitled to his opinion." That is the diplomatic version of saying your president is wrong.

The Warning Signs Were Already Posted

CISA, the federal cybersecurity agency, had been warning for months before these attacks that Iran might try to compromise water utilities and other critical infrastructure. Those warnings existed. They were public. The vulnerabilities in internet-connected operational technology systems used by water facilities are well documented and have been highlighted repeatedly by federal officials.

Orleans told the Times that Iran was likely racing to infiltrate as many networks as possible before affected facilities could protect themselves against "the opportunistic tradecraft that the U.S. government has offered multiple, explicit warnings about." Read that again slowly. The government warned facilities what to watch for. The attacks came anyway. And the president, when asked about it, blamed a Democratic-governed state for noticing.