Iran is hacking American water systems, and the president is blaming his political rival instead

Federal investigators are working to determine who was behind last month's coordinated cyberattacks on Minnesota's drinking water systems. Consensus among investigators points toward Iran, but the FBI, EPA, and CISA have all stopped short of formally blaming anyone 1. CISA would not confirm reports about Iran's possible connection when the BBC asked 2. President Donald Trump did not wait.

At a cabinet meeting on Friday, Trump dismissed the possibility of Iranian involvement outright. "I don't think so. I think I blame it on Minnesota because they're grossly incompetent," he said, calling Governor Tim Walz "corrupt" without offering evidence 2. The gap between a careful intelligence process and a reflexive political response is not cosmetic. The framework that keeps American water safe runs on trust.

The attacks

At least 30 community water systems in Minnesota were hit by a coordinated cyberattack on July 26 and 27 1. The attackers targeted programmable logic controllers, or PLCs, devices that monitor water pressure, chemical dosing, and other features in water systems 3. They changed passwords to lock out operators 2. Some utilities issued boil-water notices and switched to manual operation. No contamination of water supplies has been reported 3.

The FBI and EPA issued a joint public service announcement warning that water and wastewater companies in at least seven states had reported similar incidents, with some leading to degraded water options 2. Wisconsin separately detected malicious cyber activity at its water facilities and urged utilities to take immediate action 3.

What the agencies say

US and state officials are treating Iran as one of the suspects behind the hack but have not made a formal determination and are wary of false flags 3. The FBI, EPA, and CISA have stopped short of officially blaming Iran, though consensus is that Iran is likely behind the attacks 1.

Iran does have a documented track record. In April, CISA issued guidance warning that Iranian-affiliated hackers were attacking internet-connected operational devices, including PLCs made by Rockwell Automation 2. In late July, CISA updated that advisory to include devices made by other companies 2.

The disconnect

Trump's response cuts against the investigators' preliminary assessment and substitutes a different narrative: that domestic incompetence, not a foreign adversary, caused the problem.

"Iran should be so lucky," Trump said. "Iran's got bigger problems than worrying about Minnesota" 3.

Walz pushed back: "Trump knows exactly who is responsible for this attack, and knows that other states were hit too" 2. He called the cyberattacks an example of what modern warfare looks like and accused the now-defunct Department of Government Efficiency of gutting CISA, leaving the US exposed to cyber-attacks 2.

Why the trust gap matters

The US cyber-response framework runs on a chain of trust. Utilities detect intrusions and report them. State and federal agencies investigate and attribute. The public takes the warning seriously enough to patch, upgrade, and prepare. Every link depends on credibility.

When the president publicly rejects his own agencies' preliminary assessment and replaces it with an evidence-free alternative, he does more than disagree. He signals to every utility manager and local official that attribution is a political opinion, not the product of intelligence work. Utilities that already hesitate to disclose breaches, fearing reputational damage, now have another reason to stay quiet: if the president will not back the FBI's findings, why risk going public? Patching slows when the threat is treated as contested rather than confirmed. And adversaries gain something more valuable than network access. They gain plausible cover. If attribution is just partisan spin, then denial becomes a working strategy.

The water sector has struggled for years with funding and training to defend itself from cyber threats 3. Gus Serino, a longtime cybersecurity specialist focused on the water sector, called the scale and coordination of the Minnesota attacks "unprecedented" 3. John Israel, Minnesota's chief information security officer, said the state had provided information to the federal government, which is evaluating the activity to determine whether it can be attributed to a specific threat actor 2.

That is the methodical process of attribution doing its job. Trump short-circuited it with a few sentences at a cabinet meeting.

Infrastructure security does not fail only when hackers improve their tools. It fails when the institutional trust connecting detection, reporting, and response starts to erode. Every time a political figure overrides intelligence attribution for domestic advantage, that trust weakens. The systems that keep water flowing through American communities cannot wait for the politics to settle.