Summary (tl;dr)

U.S. intelligence agencies suspect Iranian-backed hackers are behind recent cyberattacks on over 30 municipal water systems in Minnesota and at least seven other states, escalating a five-month military conflict between the U.S. and Iran, while President Trump publicly dismissed Iran's involvement and blamed Minnesota.

Essential Background

Tensions between the United States and Iran have been high, escalating into a military conflict that began on February 28, 2026. For months, federal cybersecurity officials had warned that Iranian-affiliated actors were actively targeting internet-exposed industrial control systems, particularly Programmable Logic Controllers (PLCs), in U.S. water, energy, and government sectors, sometimes causing disruptions and financial losses. Notably, Iran-linked hackers, including a group known as "CyberAv3ngers," previously targeted U.S. water utilities in late 2023 in Aliquippa, Pennsylvania, and in June 2026 in California.

The Full Story

This week, over 30 municipal water systems in Minnesota were hit by coordinated cyberattacks, with incidents also reported in at least seven other states. U.S. intelligence agencies and investigators have preliminarily concluded that Iranian hackers were likely responsible, viewing these attacks as a direct escalation in the ongoing military conflict between the two nations. The hackers targeted automated systems, specifically programmable logic controllers (PLCs), by exploiting internet-connected devices, often using default passwords, to disrupt operations. While many affected systems successfully switched to manual operations, preventing widespread service disruptions or water quality issues, some cities, like Braham, Minnesota, briefly advised residents to conserve water. President Donald Trump, however, publicly dismissed claims of Iranian responsibility during a Cabinet meeting, instead blaming Minnesota's "gross incompetence" for the breaches, drawing sharp criticism from Governor Tim Walz.

Why It Matters

These cyberattacks underscore the increasing vulnerability of critical infrastructure, such as water systems, to state-sponsored hacking groups amid geopolitical tensions. The attacks, even if not causing widespread public health crises this time, highlight the potential for severe disruption and the need for enhanced cybersecurity measures at utility companies, many of which are small and lack adequate resources. The differing narratives from U.S. intelligence and President Trump further complicate the national response and demonstrate the political dimensions of cyber warfare. The perceived escalation by Iran-linked actors also signals a worrying trend in the nature of modern conflict, moving beyond traditional battlefields to digital infrastructure.

Geographic Location

• Braham, Isanti County, Minnesota, United States (well and water treatment plant controls disabled)
• Plymouth, Hennepin County, Minnesota, United States (IT division disconnected cellular-connected equipment at water towers and wastewater stations due to compromise)
• South St. Paul, Dakota County, Minnesota, United States (automated water utility controls compromised)
• Maple Plain, Hennepin County, Minnesota, United States (declared local state of emergency due to similar cyberattack)
• Aliquippa, Beaver County, Pennsylvania, United States (municipal water pumping station hacked in late 2023 by Iran-linked group)
• Camp David, Frederick County, Maryland, United States (President Trump's Cabinet meeting where he commented on the cyberattacks)
• Iran (accused origin of cyberattacks)