Trump downplays suspected Iranian cyberattacks on Minnesota water systems

Donald Trump used a Cabinet meeting at Camp David on Friday to dismiss suspected Iranian involvement in cyberattacks on Minnesota water systems, even as federal investigators were treating Iran as a possible source in a broader probe of U.S. critical infrastructure.

More than 30 community water systems in Minnesota were affected by malicious cyber activity, forcing some utilities to switch to manual operations. At least one water plant was briefly offline. Investigators have said their assessment of Iran’s role was preliminary, and they saw no indications that any water supply had been rendered unsafe to drink.

Trump drew a direct contrast with that line of inquiry, saying, "They blame it on Iran. I don't think so. I think I blame it on Minnesota because they're grossly incompetent." He also singled out Minnesota Democratic Gov. Tim Walz, deepening the split between the White House message and the warnings coming from federal cyber investigators.

Walz fired back and accused Trump of lying about the cyberattack. The exchange turned the Minnesota incidents into a public test of how the federal government communicates during suspected foreign cyber operations, especially when the president is publicly discounting the same threat his administration is examining.

The Minnesota case did not stand alone. Federal authorities were investigating possible Iranian involvement in cyber incidents affecting water and wastewater systems in at least seven states. A joint cybersecurity advisory from the EPA, FBI, CISA and NSA later warned water utilities about Iranian-linked threats and exposed industrial control systems, signaling that the problem reached beyond one state’s water network.

Earlier coverage tied the campaign to the Iranian-affiliated group CyberAv3ngers, and investigators believed the attack bore the hallmarks of Iranian-backed hackers. One report also pointed to an unpatchable PLC flaw as a possible entry point in the Minnesota systems, a detail that matters because programmable logic controllers sit at the center of plant operations and can be difficult to secure once exposed.

For Minnesota utilities, the immediate fallout was operational. Manual mode kept water systems running after the attack disrupted technology, but the president’s public dismissal raised a different concern: whether local officials, plant operators and the public will hear the same message from Washington when the next alert arrives.