There is a version of this story in which a president is briefed on a coordinated cyberattack against American drinking water, expresses concern, and directs his agencies to find out who did it. That is not the version we got.
At a Cabinet meeting at Camp David on Friday, Donald Trump was asked about the attack that hit more than 30 community water systems across Minnesota. He did not describe it as an attack on Minnesota. He described Minnesota as the perpetrator.
“You know who’s behind it? Minnesota. Because they’re grossly incompetent. I think the governor’s behind it. I don’t think there was an Iranian cyberattack,” he said.
Read that again, because the distinction matters and it will get flattened in most coverage. Accusing a state of failing to defend itself is an ordinary political attack. Accusing a sitting governor of carrying out a cyberattack on his own state’s water supply is an accusation of a serious federal crime, made from the podium, by the president, against a political opponent, with nothing behind it. He went on to call Walz corrupt and to say Minnesota is one of the worst-run states in the country. He offered no evidence, no alternative theory, and no explanation for why the agencies he oversees are saying the opposite of what he is saying.
What actually happened
Hackers hit more than 30 Minnesota community water systems on the night of Sunday, July 26 and the morning of Monday, July 27. Minnesota IT Services described it as one of the largest attacks on local water infrastructure in the state’s history.
The attackers targeted operational technology, the category of equipment that performs physical work. Specifically, they targeted internet-facing programmable logic controllers, the devices that tell pumps, valves, wells, and treatment equipment what to do. In its public service announcement issued Thursday, the FBI identified the targeted hardware as Rockwell Automation and Allen-Bradley MicroLogix 1100 and 1400 series controllers. Once inside, the actors changed IP addresses and passwords, locking utility operators out of monitoring and control of their own systems.
This is the part that separates a water utility hack from a data breach. When the compromised computer controls a valve, the consequences are left with the computer. A memo distributed by the Minnesota Bureau of Criminal Apprehension, obtained by CNN, assessed that the attackers’ likely goal was to cause loss of system pressure and, through that, potential contamination of the water supply. The FBI’s own announcement makes the same point in plainer terms: pressure loss in a water system can allow untreated groundwater to seep into pipes.
Nobody in Minnesota got sick, and utility operators switched to manual control as the state activated its cybersecurity incident response, and state and federal teams spent the week helping utilities contain and remediate the damage. One community asked residents to conserve water for a couple of hours while crews figured out what was wrong. Minnesota health officials have reported no compromise of any municipal water supply.
It was not just Minnesota
The FBI and EPA announcement states that water and wastewater utilities in at least seven states have reported incidents since July 27, and that some of that activity degraded water operations. The announcement does not name the states. It does describe the effects: loss of pressure, flooding, operators locked out of their equipment, and utilities forced to run portions of their systems by hand. Some utilities issued boil-water notices. CISA said separately that it is seeing a significant increase in actors targeting these controllers in the water sector.
Wisconsin is the second state to surface publicly. Officials there detected malicious activity at water facilities on Monday and circulated a Department of Natural Resources memo, also obtained by CNN, urging utilities to take immediate action to prevent serious impacts to their systems.
Wisconsin also has a Democratic governor. Wisconsin is also a state Trump carried in 2024, with an open race for that governor’s seat on the ballot in November. The president has not said one word about Wisconsin.
The warnings came first
The most damning fact here is not that Trump lacks evidence. It is that his own government produced the evidence pointing the other way, and did it before the attack happened.
On April 7, the FBI, CISA, NSA, EPA, Department of Energy and US Cyber Command published a joint cybersecurity advisory, AA26-097A, warning that Iranian-affiliated actors were exploiting internet-facing operational technology across US critical infrastructure. The agencies updated it on July 22, four days before the Minnesota attack, to expand the range of affected manufacturers and add fresh indicators of compromise.
The advisory d states that since at least March, the authoring agencies identified an Iranian-affiliated group disrupting the function of PLCs across the Government Services, Water and Wastewater, and Energy sectors, with some victims suffering operational disruption and financial loss.
It describes attackers modifying the logic inside these devices and notes that, in observed cases, the changes disabled critical shutdown and alarm functions, allowing systems to enter unsafe conditions without alerting the operators monitoring them.
That is a document produced by six federal agencies under this president, describing this attack, four days early.
Federal and state investigators are now treating Iran as a leading suspect. Officials told the New York Times, which first reported the possible connection, that the tradecraft used and the complete absence of any ransom demand pointed toward Iranian involvement. Iran’s interest in American water infrastructure is not new. The Justice Department charged Iranian hackers in 2016 over an intrusion at a small dam outside New York City, and Iranian-linked groups have hit US water utilities repeatedly since.
It’s important to note that no formal attribution has been made,, and oofficials have been careful to call the assessment preliminary, while some are actively examining whether a different actor staged the intrusion to appear Iranian.
That caution is appropriate, and it’s also the exact opposite of what the president did. He did not withhold judgment pending forensics. He reached a conclusion instantly, and the conclusion was that the Democratic governor of a state he has lost twice attacked his own constituents’ water.
Why this is worse than a bad soundbite
It is tempting to file this under the usual heading of Trump saying something absurd and moving on. That undersells the damage, for three reasons.
First, it is a message to adversaries. If a foreign state probes American critical infrastructure and the American president’s public response is to blame the victims and deny the attack occurred, the deterrent value of the entire federal cybersecurity apparatus drops. There is no cost imposed on an actor whose intrusion the president refuses to acknowledge.
Second, it punishes disclosure. Minnesota did the right thing. State officials went public quickly, briefed the press, coordinated with federal partners, and shared threat intelligence with other states. The reward was the president of the United States calling them incompetent and criminal on national television. Every state emergency manager watching that exchange now understands that transparency carries a political cost. The next state may take longer to say anything.
Third, it is a substitute for a response. Water systems in this country are exposed for structural reasons. The sector is made up of thousands of small, underfunded utilities running aging equipment, many with no dedicated IT staff at all, and federal auditors have found for years that a large share of the systems they inspect fall short of basic cybersecurity requirements. That is a solvable problem, and solving it requires money, standards, and sustained federal attention. None of that gets discussed in a Cabinet meeting spent on a grudge.
Somebody reached into the machinery that treats American drinking water and tried to break it. The president of the United States watched it happen and went looking for a Democrat to blame.
Democratic Reporter is funded by readers like you — no corporate owners, no billionaires. If you value independent political journalism, subscribe and share this piece.
