Investigators have advanced their assessment that Iranian hackers were likely behind a coordinated cyberattack targeting more than 30 water systems in Minnesota, according to multiple officials briefed on the investigation.
Minnesota IT Services confirmed the attack targeted operational technology at municipal water systems on Sunday and Monday. Officials told The New York Times that three state officials briefed on the investigation said the tradecraft used and the absence of a ransom demand led analysts to initially determine Iran was involved. Investigators cautioned the assessment could change as more data is collected.
What the Right Is Saying
President Donald Trump disputed the Iran attribution during a Cabinet meeting Friday, saying he blames Minnesota and Gov. Tim Walz instead.
"They like to say 'oh it's Iran.' Iran should be so lucky. Iran's got bigger problems than worrying about Minnesota," Trump said, calling Walz "the corrupt governor of Minnesota" and attributing the incident to state incompetence.
Republican national security officials have emphasized that foreign cyber threats to critical infrastructure require vigilance but noted that attribution assessments often evolve as investigators gather more evidence.
What the Left Is Saying
Democratic lawmakers said the reported attribution underscores the need for sustained federal investment in protecting water infrastructure from foreign threats. Rep. Jamie Raskin of Maryland, a member of the House Oversight Committee, has previously stated that critical utilities must receive equivalent cybersecurity attention to what has been devoted to electrical grids.
Environmental justice organizations have raised concerns that such attacks could disproportionately affect communities with fewer resources to respond to service disruptions. The Minnesota Department of Health said it is not aware of any active requests from cities asking residents to modify drinking water usage.
What the Numbers Show
Minnesota IT Services reported hackers targeted 36 municipal water systems, according to MNIT Assistant Commissioner John Israel.
The New York Times reported Iranian-affiliated actors have targeted devices spanning multiple U.S. critical infrastructure sectors, including Water and Wastewater Systems, Energy, Government Services and Facilities facilities.
CISA Acting Director Nick Andersen confirmed the agency was aware of "multiple potential incidents affecting local water utilities."
In Braham, Minn., city officials said a plant operator found the water tower calling for water while the well was not operating. Staff determined the computerized control system had been compromised. The plant was restored within approximately 90 minutes using backup systems.
The FBI stated it is "aware of recent public reporting around Water and Wastewater sectors" and that it and interagency partners are "fully engaged to protect critical infrastructure."
The Bottom Line
Investigators have narrowed their focus to Iranian hackers as the likely source, but caution the assessment remains preliminary. MNIT said Minnesota was among early detectors of the threat activity and noted the same tactics appear to be occurring in other states.
The incident highlights growing concerns about foreign actors targeting municipal water infrastructure. CISA had issued an advisory warning U.S. organizations of ongoing Iranian-affiliated cyber activity targeting internet-connected operational technology devices in the days before the Minnesota attack. The investigation remains active, with federal and state officials collaborating on attribution and defensive measures.