Iran, Incompetence, or Both? Washington Splits Over Who Hacked Minnesota's Water

Overnight on July 26-27, a coordinated cyber intrusion hit operational technology at more than 30 community water and wastewater systems across Minnesota. Four municipalities went public: Braham's water treatment plant was knocked offline entirely, prompting a temporary appeal to residents to limit water use; Plymouth lost cellular links at two water towers and several wastewater lift stations but kept running manually; South St. Paul and Maple Plain both had automated controls affected, with Maple Plain declaring a local emergency to support its response.

Minnesota IT Services (MNIT) activated a statewide incident response and has been explicit on two points: no water quality or safety issue has been detected anywhere, and no formal attribution has been made. What MNIT will say is that the intrusions share timing, methods of access, and targeted infrastructure characteristics with a known pattern of prior attacks.

That known pattern has a name in federal circles. On July 22, four days before the Minnesota intrusions began, CISA, the FBI, NSA, EPA, the Department of Energy, and U.S. Cyber Command updated a standing joint advisory (AA26-097A, originally issued April 7) tracking an Iranian-affiliated campaign against internet-exposed PLCs. The update added Treasury as a co-author, broadened the vendor scope from Rockwell Automation alone to include Schneider Electric and Siemens controllers, and made multi-factor authentication on all remote OT access an explicit requirement, alongside removing PLCs from direct internet exposure and locking down cellular modem access. The advisory's technical root cause is CVE-2021-22681, an unpatchable authentication-bypass flaw in Rockwell's engineering software; reporting has put the number of exposed Rockwell devices in the U.S. above 3,000.

A second, narrower document followed the Minnesota attacks directly: an FBI/EPA Public Service Announcement issued July 30, naming Rockwell's MicroLogix 1100 and 1400 series specifically and confirming that utilities in at least seven states, not just Minnesota, have reported similar incidents since July 27. That PSA is the source of the most operationally serious detail: some victims experienced not just loss of visibility but actual loss of pressure and, in at least one case, flooding, the kind of physical-layer disruption that raises the stakes beyond a pure IT event, even though no water supply has been confirmed contaminated.

Enter the politics. On July 31 at a Camp David cabinet meeting, President Trump rejected the Iran theory outright, telling reporters he blames Minnesota because they're grossly incompetent, and directing the blame at Gov. Tim Walz personally, calling him corrupt. Trump did not offer an alternative theory of who was behind the intrusions if not Iran. The White House declined to clarify further when pressed. Walz responded on X that Trump knows exactly who is responsible for this attack, and knows that other states were hit too. Cybersecurity figures pushed back publicly, with one former senior FBI cyber official noting simply that his own intelligence services are attributing this to Iran.

Where this sits: Three state officials have told reporters the hallmarks, no ransom demand, the specific access method, point toward Iran or an Iran-affiliated group like CyberAv3ngers. But hallmarks pointing toward is not the same as attribution, and no U.S. agency has put its name on that claim yet. What's confirmed: the incident, the seven-state spread, the operational disruption, and the President's public break with his own agencies' preliminary lean. What's unconfirmed: everything about who actually did it.

Fact-check note: this brief distinguishes AA26-097A (the six-agency standing advisory, updated July 22, which contains the MFA mandate) from the FBI/EPA PSA (July 30, Minnesota-specific, no explicit MFA language). Treat these as two separate documents, not one.