PA
US President Donald Trump says Minnesota and its governor are to blame for recent cyber-attacks on water systems in the state after US investigators suggested Iran may have carried them out.
“They blamed it on Iran. I don’t think so. I think I blame it on Minnesota because they’re grossly incompetent,” Trump said without evidence during a cabinet meeting on Friday, calling the state’s Democratic Governor Tim Walz “corrupt”.
Walz responded by saying: “Trump knows exactly who is responsible for this attack, and knows that other states were hit too.”
Their remarks come after Minnesota’s state IT agency said dozens of community water systems faced a “coordinated cyber-attack” earlier this week.
The incidents happened on 26 and 27 July, when equipment was remotely monitored and controlled, according to the agency.
US investigators have since been looking into whether the incidents may have been carried out by Iran, according to media reports.
The investigators cautioned that their assessment was preliminary and could change as more data was collected, but comes amid the US-Israel war in Iran and on-and-off negotiations to halt the constant stream of strikes in the region.
The BBC contacted the CISA, which would not confirm the reports about Iran’s possible connection to the Minnesota attacks.
The Cybersecurity and Infrastructure Security Agency (CISA) later warned of a significant increase in hackers targeting water and wastewater systems.
They said hackers have been targeting automated computers that control systems, known as PLCs, and changing passwords to lock out operators. Boil water notices been issued and systems have had to be operated manually as a result.
“They like to say, ‘Oh, is Iran.’ Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota,” Trump also said on Friday in an apparent reference to the ongoing conflict between Tehran and the US.
Walz, meanwhile, said the cyber-attacks are an example of “what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran”.
He accused the now defunct Department of Government Efficiency (Doge), the government body formerly tasked with reducing US government spending and cutting jobs, of gutting the CISA – leaving the US exposed to cyber-attacks as a result.
“Thankfully, our experts in Minnesota were able to identify the vulnerability quickly and work with local communities to stop it,” Walz added.
The FBI and Environmental Protection Agency (EPA) have also issued a joint public service announcement to warn that water and wastewater companies in at least seven states had reported similar incidents, with some of these leading to “degraded water options”.
“After remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality,” they stated.
The US has 152,000 public drinking water systems and more than 16,000 wastewater treatment systems. According to the CISA, these systems are vulnerable to threats.
Regarding the Minnesota incidents, the state’s IT agency said in a statement that while investigators confirmed there had been “malicious activity involving a system’s technology”, not all communities there were impacted by a disruption of services.
“We have provided relevant information to the federal government, which is evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor,” John Israel, Minnesota’s chief information security officer, said in a statement.
US federal agencies have previously issued advisories warning about the threat of cyber-attacks on water and wastewater systems from foreign groups, including groups from Iran.
In April, CISA issued guidance warning that Iranian-affiliated hackers were attacking internet-connected operational devices, including PLCs, made by Rockwell Automation.
Earlier this month, it updated its advisory to include devices manufactured by other companies.
United States
Cyber-security
Cyber-crime
Cyber-attacks
