The documented part first. Nine water systems in Michigan and 30 sites in Minnesota have reported cyberattacks targeting operational technology, the programmable logic controllers that run pumps and treatment. Officials say water supplies were not disrupted, and the FBI says it is "fully engaged to protect critical infrastructure." [2] CBS reports more than 30 community water systems affected across Minnesota, with the federal investigation into a possible Iran link spanning at least seven states [1].
The attribution is where the record gets careful, and the caution is verbatim. Per CBS: "Sources cautioned that since they had not definitively attributed the attack, their assessment could change as additional technical evidence is collected." [1] Investigators are also, per the same reporting, probing "whether the actor could have attempted to appear Iran-based as a way of stirring the pot amid the ongoing U.S. conflict with Iran." [1] The Iran suspicion is the investigation's premise. It is not yet its finding.
The president's version does not match his own investigators'. "I think that Minnesota is behind it... I don't think there was an Iranian cyberattack. I think that Minnesota ought to get its act together." [1] Al Jazeera reports he offered no evidence for that attribution [2].
The governor's version points the other way. Tim Walz said the administration "took an axe" to federal cybersecurity agencies and "left the U.S. exposed to cyber attacks," adding, "Trump knows exactly who is responsible for this attack." [1] Al Jazeera reports Walz pointed to Iran, consistent with earlier FBI warnings about Iranian-linked targeting of American water infrastructure [2]. His attribution, like the president's, goes beyond what the investigators have publicly established [1][2].
Circulating coverage goes further than the fetched record in both directions. At least one technology outlet's headline asserts the US government has confirmed Iran is behind the attacks; that outlet is not fetchable under our sourcing rules, and its claim is inconsistent with CBS's reporting of a non-definitive attribution and with the president's own on-record denial. The conflict is noted here as it stands, unresolved. Separately, a joint CISA, FBI, EPA and NSA advisory on Iran-affiliated threat actors targeting water-system controllers exists, and whether it freshly attributes this incident or reissues a general warning first published in April could not be confirmed: the advisory page returned a 403 to our fetch.
What remains is a record with three incompatible attributions in it: an unnamed and possibly disguised actor, per the investigators; Iran, per the governor; Minnesota itself, per the president. Only the first comes from the people reading the forensics, and it is the only one phrased with the humility the evidence currently requires.
