U.S. investigators believe a cyberattack that targeted dozens of water systems in Minnesota this week likely was orchestrated by Iranian hackers, a report said.
Minnesota IT Services (MNIT) said the "coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems" on Sunday and Monday, but the Minnesota Department of Health is "not aware of any active requests from Minnesota cities to have their residents modify their drinking water usage."
U.S. and state officials and others familiar with the incident told The New York Times that Iranian hackers were likely behind the cyberattack.
The newspaper reported that three state officials briefed on an investigation into the cyberattack said the tradecraft used and the absence of a ransom demand led analysts to initially determine Iran was involved. Officials also cautioned that the assessment could change as more data is collected by investigators, according to the newspaper.
However, President Donald Trump said during a Cabinet meeting Friday that he would "blame it on Minnesota and the governor."
"Today, I just want to mention that, we heard in Minnesota there was a cyberattack, and they blame it on Iran. I don't think so. I think I blame it on Minnesota because they're grossly incompetent. There was a cyberattack of 30 water plants, and I would blame it on Minnesota and the governor, the corrupt governor of Minnesota," Trump said, referencing Minnesota Gov. Tim Walz, a Democrat. "They like to say, 'oh it's Iran.' Iran should be so lucky. Iran's got bigger problems than worrying about Minnesota."
In a statement shared with Fox News Digital, MNIT noted that "the investigation remains active, and Minnesota has not attributed the activity to a specific actor."
MNIT said it "continues to collaborate with federal, state, local, Tribal, and private-sector partners to investigate the attack, support affected communities, and strengthen the security of Minnesota's critical infrastructure."
"Cyberattacks against critical infrastructure require a coordinated, whole-of-government response," John Israel, MNIT assistant commissioner and Minnesota chief information security officer, said in a statement. "MNIT is working side by side with our partners to share intelligence, support affected communities, and help utilities restore operations safely while strengthening defenses against future attacks."
Israel told the Times that the breach was first detected Sunday and that hackers targeted 36 municipal water systems.
"Minnesota was one of the early detectors of this, but we’re seeing that this same threat activity has likely been occurring in other states throughout the nation," he was quoted as saying.
Nick Andersen, the Cybersecurity and Infrastructure Security Agency’s (CISA) acting director, told the newspaper that the agency was aware of "multiple potential incidents affecting local water utilities."
In the days leading up to the incident, CISA issued an advisory warning U.S. organizations of "ongoing Iranian-affiliated cyber activity targeting internet-connected operational technology (OT) devices."
"Iranian cyber actors continue to target U.S. critical infrastructure, and the FBI is committed to identifying, disrupting, and imposing costs on those responsible," Assistant Director Brett Leatherman of the FBI’s Cyber Division said in the advisory.
It stated that a "group of Iranian-affiliated actors" has "targeted devices spanning multiple U.S. critical infrastructure sectors, including Water and Wastewater Systems, Energy and Government Services and Facilities, to include local municipalities."
The Federal Bureau of Investigation (FBI) and Environmental Protection Agency (EPA) also issued an advisory on Thursday "to warn critical infrastructure asset owners and operators that malicious cyber actors are conducting cyber attacks targeting Operational Technology devices."
"Since 27 July 2026, Water and Wastewater Sector utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations," it added.