Trump does not think Iran was behind cyberattack against over 30 Minnesota water systems

What Happened

On 10 and 11 May 2025, a cyberattack targeted over 30 municipal water systems in Minnesota, according to Minnesota IT Services. The attack prompted a response from government and municipal agencies, but no instructions were issued to residents regarding drinking water. On 15 May, The Washington Post, citing unnamed US officials, reported that Iran was behind the intrusion. US President Donald Trump subsequently stated he did not think Iran was responsible. The same week, the US Cybersecurity and Infrastructure Security Agency (CISA) warned of a significant increase in threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) sector. Security analysts from Dataminr, Dragos, and Sublime Security noted similar attacks on vulnerable US water and energy systems since the start of the war between Israel and Hamas in October 2023, describing them as targeting 'low-hanging fruit' and aimed at psychological effect rather than destruction.

Key Actors

Why It Matters

The incident reflects the persistent vulnerability of US critical infrastructure to cyber intrusions amid heightened geopolitical tensions with Iran. The contested attribution — with a US president publicly dismissing his own officials' assessments — creates ambiguity that could embolden further operations or complicate diplomatic signalling. The focus on water systems underscores a shift toward targeting essential services for psychological impact, potentially eroding public trust in infrastructure resilience.

Watch For

Monitor whether additional forensic evidence emerges to support or refute Iran's involvement, whether further water or energy sector intrusions occur, and if CISA or the FBI issue a formal attribution. Also watch for any Iranian state response or cyber retaliation in the context of broader US-Iran friction.