Trump Blames Minnesota Leadership After Iranian Cyberattacks Hit Water Systems

A coordinated cyberattack targeted municipal water systems across at least seven U.S. states during the last week of July 2026, with more than 30 community systems in Minnesota affected. The attackers targeted programmable logic controllers (PLCs), specifically Rockwell Automation's MicroLogix series, to change passwords and lock out operators. In Braham, Minnesota, a treatment plant went offline for two hours, while other sites experienced water pressure loss and flooding. Federal agencies confirmed that while some utilities issued boil-water notices, water quality remained safe.

Donald Trump rejected preliminary findings from U.S. and state investigators suggesting Iranian-linked hackers were responsible. During a cabinet meeting at Camp David, Trump attributed the disruptions to the "grossly incompetent" administration of Minnesota Governor Tim Walz. Governor Walz defended the state's response, characterizing the intrusions as "what modern warfare looks like" and accusing the Trump administration of gutting the Cybersecurity and Infrastructure Security Agency (CISA).

Despite the presidential denial, a leaked memo from the Minnesota Fusion Center indicated the tradecraft aligned with Iranian cybersabotage campaigns, potentially involving groups like Handala or CyberAv3ngers. CISA, the FBI, and the EPA issued urgent warnings to water utilities nationwide, observing a significant increase in threat actors targeting operational technology. They urged operators to remove publicly exposed PLCs from the internet to prevent further disruptions.