Trump blames Minnesota for water cyberattack

They blame it on Iran. I don't think so. I think I blame it on Minnesota because they're grossly incompetent. CBS News Homeland Security Correspondent Nicole Sganga joins me now. What do we know? Let's talk about why we know almost certainly this is Iran, just to push back a little bit on what President Trump said there.

Seems like a gratuitous thing. Look, this does not look like a smash and grab, Major. There was no ransom demand. There was no obvious financial incentive. The apparent goal here is disruption. That is straight from the Iranian playbook. And then there's history. We can go all the way back to 2011 and look at Iranian attacks on US banks and the Bowman Avenue dam in Rye, New York, all through the Las Vegas Sands destructive attack in 2014, 2020 and 2024 presidential campaign hack-and-leak operations, as well as disinformation campaigns--

All Iran sourced. --in 2020. All Iran. But the one we should really look at is 2023 and 2024, where the Cyber Avengers, who were loosely directed by the IRCG, targeted internet-connected controllers used by US water facilities and other critical infrastructure in order to basically disconnect equipment or force people to use manual operations. And they did this just by using default passwords to gain entry into the system. One of the things we've been talking about a lot today is this term PLCs, Programmable Logic Controllers. They're small computers. They're internet facing. They operate pumps, valves, pressure systems, chemical dosings, and alarms at these water utility and wastewater utilities across the country. And in this particular campaign, Major, attackers changed the IP addresses and passwords, locking out some operators, and forcing utilities to go into manual mode. One of the leading theories, talking to cyber experts today, is that they were trying to quietly establish access, and they actually outed themselves. They exposed themselves in what is part of a broader plan, perhaps even geopolitical plan, to say, look, we have access, gained access into the systems-- And we are threatening you.

Yes. We'll do all this privately, but you know that we have capabilities that could be deeply disruptive. And one of the things we haven't seen reported yet, Major-- I mean, you mentioned the seven states. Minnesota is the only one that has come out publicly. I want to be careful here because no one else has sort of raised their hand, but we know these same exact technologies, these kinds of PLCs, are used in states like Texas, Wisconsin, Ohio, Michigan. Here's the other thing. Even a limited attack can have a really outsized effect. So you don't have to poison the water to frighten a community. You only have to make people question whether or not their water is safe. And, Nicole, I've had my attention directed lots of different places today, so forgive me for not knowing this. I should. What's happened at the community levels in Minnesota? Has anyone noticed anything? Yeah, so at the community levels, at this point, we understand that the drinking water is safe. It is fine. But we have seen flooding in certain communities. We have seen forcing to go into manual operations versus using these internet-facing systems. There's a larger question here of, should water utilities even be internet facing? So, right now, there's a lot of detection. We should also point out that 50% of drinking-water utilities nationwide are privately owned. So, basically, the FBI and CISA are screaming from the top of a mountain right now waging a public awareness campaign to say, lock this down. If you use PLCs, take them down from the internet. Go into manual controls. But there's not a ton they can do to compel an already stretched-thin sector of critical infrastructure to take this seriously. Comprehensive as always. Nicole Sganga, thank you very, very much. Thank you.