President Donald Trump on Friday blamed Minnesota’s Democratic governor, Tim Walz, rather than Iran for the cyberattacks that hit more than 30 water systems in the state, breaking with investigators in his own administration who have been probing a possible Iranian role. Speaking at a Cabinet meeting at Camp David, Trump said: “We heard in Minnesota there was a cyberattack and they blame it on Iran. I don’t think so. I think I blame it on Minnesota because they’re grossly incompetent.”
Trump also called Walz “the corrupt governor of Minnesota” and dismissed suggestions that Tehran was behind the intrusions. “They like to say, ‘Oh, it’s Iran.’ Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota,” he said. U.S. officials had earlier told ABC News that authorities were investigating whether Iran or hackers associated with the country were behind the attacks, which hit Minnesota water utilities on the nights of July 26 and 27 in what Minnesota IT Services (MNIT) described as a coordinated attack.
Walz hit back on social media. “Trump knows exactly who is responsible for this attack, and knows that other states were hit too. This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran,” he wrote. The governor also blamed the Department of Government Efficiency for weakening federal cyber defenses, saying “DOGE took an axe to CISA and left the U.S. exposed to cyber attacks.”
The dispute unfolded as the FBI and the Environmental Protection Agency issued a public service announcement Thursday warning that water and wastewater utilities in at least seven states had reported incidents since July 27, with some activity degrading water operations. The advisory did not name the states, but sources told ABC News that Georgia and Michigan were reporting similar attacks on local water systems. The FBI said it was “fully engaged” with interagency partners to protect critical infrastructure.
According to the federal advisory, attackers targeted specific brands of internet-facing programmable logic controllers (PLCs), including Allen-Bradley MicroLogix 1100 and 1400 series units made by Rockwell Automation, changing configurations, IP addresses and passwords and locking out operators. In at least one victim organization, hackers modified the PLC project files governing the physical equipment. “Operational effects reported to the FBI have included loss of pressure and flooding. Pressure loss in water systems could potentially allow untreated ground water to seep into pipes,” the advisory said.
A memo from the Minnesota Bureau of Criminal Apprehension obtained by CNN said the “likely desired impact of the intrusion at the water facilities was to cause loss of system pressure and subsequent potential contamination of water supply.” No contamination has been confirmed. The Minnesota Department of Health said drinking water quality was unaffected at all systems hit and no statewide boil-water advisories were issued, though the Cybersecurity and Infrastructure Security Agency said some larger attacks elsewhere had resulted in boil water notices and sustained manual operations.
Craig Sixta, chief technology officer at Element Technologies and a 25-year cybersecurity veteran, called the scale of the campaign unusual. “To have this many municipalities get hit at once, this is fairly unprecedented,” he told CBS News, adding that if Iran was responsible, “by definition, this is an act of war or terrorism.” Investigators cautioned that their preliminary assessment could change as more technical evidence is collected, and that attackers may have tried to appear Iran-based to stoke tensions during the U.S. conflict with Tehran. In April, the FBI and NSA warned that Iranian hackers were working to exploit Rockwell Automation PLCs.
CISA acting director Nick Andersen said the agency is “currently observing a significant increase in cyber threat actors targeting programmable logic controllers at water utilities” and urged operators to “remove publicly exposed PLCs and other operational technology from the internet as soon as possible.” Democratic Senator Amy Klobuchar of Minnesota said she discussed “updated technology” with National Cyber Director Sean Cairncross, noting that resources are an issue “for so many communities, not just in Minnesota but across the country.” Wisconsin officials separately warned that the cyber threat is ongoing and “requires immediate action” to prevent serious impacts.
The attacks underscore how exposed small municipal utilities are to industrial-control intrusions, and the political fight over attribution has added a new front to the U.S. confrontation with Iran. Officials said the assessment of who is responsible could shift as forensic work continues, and state and federal investigators have not publicly attributed the activity to a specific actor.
Sources: ABC News, NBC News, CBS News, BBC, Tech Times, PCMag
Author: Technology Desk
discussion