Federal cybersecurity officials warned that "malicious cyber actors" had targeted water and wastewater facilities across at least seven US states, with Minnesota the worst affected after 30 of its water systems were hit. The disruptions caused low water pressure and prompted some utilities to issue boil-water notices, though there have been no reports of contamination. The Cybersecurity and Infrastructure Security Agency (CISA) said internet-connected systems were especially vulnerable, allowing hackers to change passwords and lock out operators, and advised affected utilities to switch to manual operation.

Anonymous officials have pointed to Iran as the likely culprit, with Tehran reportedly intensifying cyber-attacks on the US since war broke out roughly six months ago, though the FBI has opened an investigation without formally attributing blame. CISA had already warned in April, and updated its advisory on 22 July, about Iranian-backed targeting of programmable logic controllers used in water infrastructure. Donald Trump instead blamed Minnesota's governor, Tim Walz, calling the state "grossly incompetent" without evidence, prompting Walz to accuse Trump of knowing the true culprit and downplaying the risks of conflict with Iran. Similar incidents have occurred before, including Russian-linked attacks on Texas water systems in 2024.