10
Loading video...
By Steve Mollman
News Editor
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
President Donald Trump on Friday rejected reports that Iran was behind a cyberattack targeting Minnesota water systems, saying he believes state officials are at fault despite investigators reportedly examining evidence of a possible Tehran link.
"We heard in Minnesota there was a cyberattack, and they blame it on Iran. I don't think so," Trump told reporters during a Cabinet meeting at Camp David in Maryland. "I think I blame it on Minnesota because they're grossly incompetent."
Trump also dismissed the possibility that Tehran would be interested in targeting Minnesota's water infrastructure, saying: "Iran should be so lucky. Iran's got bigger problems than worrying about Minnesota."
Read More on News
Trump also took aim at Minnesota Governor Tim Walz, a Democrat, while the investigation into the attack remains ongoing.
Walz pushed back in an X post, saying Trump "knows exactly who is responsible for this attack" and adding, "This is what modern warfare looks like, and it further illustrates there's no plan to win a war with Iran."
Newsweek reached out on Friday to the FBI, Walz’s office and the White House, which pointed back to the president’s comments.
...
Investigators Reportedly Point to Iran
Trump's comments contrast with reports from multiple outlets suggesting investigators have found indications that the hackers may be linked to Iran.
Wired reported Thursday that a Minnesota Fusion Center memo said the attacks were "aligned" with an allegedly Iran-linked cyber-sabotage campaign.
Minnesota IT Services (MNIT), however, said Thursday that the state has not attributed the activity to any specific actor and that the investigation remains active. The agency said attribution requires investigators to analyze technical evidence alongside broader national and international threat intelligence.
Related Story
US-Iran War Spreads to Another Major Sea, Risking New Suez Crisis for NATO
"We have provided relevant information to the federal government, which is evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor," MNIT Chief Information Security Officer John Israel said in a statement.
No federal agency has publicly attributed the attack to Iran, and officials continue to investigate.
In an email to Newsweek, Minnesota Department of Public Safety spokesperson Mike Ernster said authorities could not comment on "an active and ongoing investigation." He said the Minnesota Fusion Center would continue working with municipalities and state and federal partners "to investigate this incident and continue working to keep our communities safe from these types of attacks."
Investigators are also examining whether the perpetrators may have sought to make the activity appear to be Iranian in origin, according to reports citing officials familiar with the probe. Authorities have cautioned that assessments remain preliminary and could change as additional technical evidence is analyzed.
The reported cyber campaign was not limited to Minnesota. CBS News reported that the FBI told state officials at least seven states were affected by the attacks. In an advisory published Thursday, the FBI said it had received reports of similar incidents in at least seven states and that some of the activity had, in some cases, "degraded water operations."
For several hours on Monday, the city of Braham, Minnesota, asked residents to minimize water use after a cyberattack shut down operating controls at its water treatment plant. City officials said the incident did not affect water quality.
On Saturday, Michigan officials said nine water systems in the state were also impacted by cyber incidents consistent with the activity described in a recent federal alert. State officials said all affected systems continued operating safely and there were no known public health impacts.
Minnesota officials said investigators have identified similarities among the incidents, including their timing and the types of technology involved. However, they cautioned that the investigation has not determined whether every incident was carried out by the same actor.
Attack Raises Infrastructure Concerns
MNIT said more than 30 community water systems were targeted in the cyberattack, drawing attention because water infrastructure is considered a critical service and has long been viewed by cybersecurity experts as a potential target for foreign adversaries and other malicious actors.
MNIT said the attackers targeted systems used to remotely monitor and control equipment, including programmable logic controllers (PLCs), which are commonly used in water and wastewater operations. It said most confirmed cases involved PLCs and human-machine interfaces (HMIs), the computer screens operators use to manage those systems.
A day before Trump's remarks, the Cybersecurity and Infrastructure Security Agency (CISA) warned that threat actors were targeting PLCs and changing passwords to lock operators out of systems.
Walz later argued in an X post that cuts linked to the Department of Government Efficiency (DOGE) had weakened CISA's ability to protect critical infrastructure. "DOGE took an axe to CISA and left the U.S. exposed to cyber attacks," he wrote, adding that Minnesota officials were able to identify the vulnerability quickly and work with local communities to respond.
Officials have not publicly detailed the full scope of the incident or identified those responsible.
MNIT spokesperson Emily Zimmer said earlier this week that investigators had not identified any ransom demand related to the cyberattack.
Minnesota officials have said there is no indication the state's drinking water supply was compromised, and there were no active requests for residents to modify their water use. They also emphasized that an "impacted" system does not necessarily mean water service was disrupted but rather that investigators detected malicious activity involving the technology.
Ernster reiterated to Newsweek that no Minnesota water supplies have been reported compromised as a result of the cyberattack.
Cybersecurity attribution can be a lengthy process, with investigators often needing weeks or months to analyze technical evidence before reaching a definitive conclusion.
If investigators ultimately determine Iran-linked actors were involved, the incident could become the latest example of cyber activity attributed to groups connected to the Iranian government. For now, however, Minnesota officials say attribution remains under investigation, and no federal agency has publicly identified a responsible actor.
Contact Newsweek editors on this story: Gabe Whisnant and Dave Siminoff.
View 0 Comments
Submit Correction
View Editorial & AI Guidelines