Nobody Has Attributed the Water Attacks. Two Officials Have Anyway.

No federal agency has publicly said who attacked American water systems. The FBI describes itself as "fully engaged" in the investigation and has made no definitive attribution. Minnesota IT Services, the state agency at the center of the response, has not determined who was responsible [1]. That is the published record on the question of authorship as of tonight.

Two of the loudest voices in American politics have answered the question anyway, in opposite directions, each in the grammar of settled fact.

President Trump, at a Cabinet meeting on July 31, put it on the state: "I blame it on Minnesota because they're grossly incompetent" [1]. CBS News reported him dismissing the alternative directly: "I don't think there was an Iranian cyberattack. I think that Minnesota ought to get its act together" [2].

Governor Tim Walz answered with a certainty of his own: "Trump knows exactly who is responsible for this attack, and knows that other states were hit too. This is what modern warfare looks like, and it further illustrates there's no plan to win a war with Iran" [1].

Those are opinions, delivered as findings. This piece does not rate them. It states the strongest version of each and then sets the record next to both.

Walz is reasoning from a pattern rather than from nothing. Research for this piece identified a joint advisory issued in April 2026 by CISA, the FBI and the EPA concerning Iranian-affiliated cyber actors exploiting programmable logic controllers across United States critical infrastructure. Programmable logic controllers are the small industrial computers that open valves and drive pumps, and they are the same attack surface turning up in the water utilities now. Moving from a documented, already attributed campaign to a fresh intrusion with a matching signature is ordinary threat-intelligence reasoning. It produces a hypothesis with real weight behind it. It does not produce a finding, and we located that advisory by title only without retrieving the document itself, which limits how much weight we can put on it here.

The case underneath Trump's line is not empty either. Attribution is genuinely unresolved, which cuts against anyone asserting Iran with confidence just as much as it cuts the other way. Municipal water systems are also a documented soft target for reasons that have nothing to do with Tehran: controllers left unpatched, exposed to the open internet, running default passwords. Cyber hygiene at the state and municipal level is a real contributing factor in this class of intrusion, a factor present in the earlier round of water-utility compromises. "The defenses were weak" and "the defenses were the cause" are separate claims carrying separate evidence requirements, and the first of them is the one currently supported by anything on the record.

Here is what investigators have actually said. Minnesota IT Services has not determined responsibility. The FBI is fully engaged and has attributed nothing [1]. CBS News, updating through August 1, reported that investigators are probing whether Iranian hackers are behind the activity that targeted water systems in seven states, and put the alternative on the page explicitly: an actor "could have attempted to appear Iran-based as a way of stirring the pot." Official confirmation, CBS reported, "can take weeks or months" [2].

That last line is what both certainties run into. Distinguishing a state actor from someone imitating one is forensic work, done on logs and malware artifacts, and it does not move at the speed of a Cabinet meeting or a social post.

One set of facts holds regardless of which man turns out to be closer. Roughly 36 Minnesota municipal water systems, and utilities in at least seven states, have been running incident response since July 27. That work has been underway for a week while the argument about authorship plays out above it.

Two gaps in our own reporting are worth stating. CISA published an alert on July 30 aimed at the water and wastewater sector and its programmable logic controllers, and the page returned an error on every attempt to retrieve it, so we cannot tell readers what attribution language, if any, it contains. No source we fetched names all seven of the affected states.

The record supports exactly one sentence about who did this: nobody in a position to know has said so publicly. Everything past that sentence, from the Cabinet room and from the governor's office alike, is argument.