Already a subscriber? Make sure to log into your account before viewing this content. You can access your account by hitting the “login” button on the top right corner. Still unable to see the content after signing in? Make sure your card on file is up-to-date.

Cyberattacks on American water systems have now hit at least seven states as federal investigators work to determine whether Iran is behind them, a theory the president publicly rejected Friday.

Getting into it: The attacks started in Minnesota, where the state IT agency said more than 30 community water systems were compromised on July 26 and 27. Most of the verified intrusions targeted programmable logic controllers (PLCs), the small industrial computers that run pumps, wells, and treatment equipment, along with the screens operators use to monitor them. A Thursday advisory from the FBI and EPA put the count at seven or more states reporting incidents since Monday, with water operations degraded in some of them.

Officials have not named the states, but a Michigan government spokesman confirmed in a statement to the New York Times that his state was among them. “We received a small number of reports from Michigan communities indicating activity consistent with what federal agencies described,” spokesman Dale George said, adding that all affected systems kept operating safely with no known public health impact.

Despite this, Trump has rejected the idea that a foreign adversary was involved at all. Asked Friday about Iran’s possible role, he said, “I think Minnesota is behind it. I don’t think there was an Iranian cyberattack.” After the remarks, federal officials privately told multiple news outlets that Iran is still the leading candidate, though nobody has locked down the technical evidence needed to say so with certainty. Investigations of this magnitude routinely run for months before anyone can name a culprit, and some never get there.

Nate George, the Republican mayor of Braham, one of the affected Minnesota cities, said the officials briefing him are not hedging much. “We’re getting bits and pieces of information from the state of Minnesota and the F.B.I.,” he said Friday. “They are pretty sure it’s Iranian actors,” though he said none of them will put that on the record. Asked about the president’s comments, the mayor said Trump is “entitled to his opinion.”

In Braham, attackers knocked out the controls running the well and treatment plant, leaving the city to lean on its water tower until public works staff cut the compromised equipment loose, switched to a backup, and had the plant running again within two hours. Plymouth, another affected Minnesota city, caught its own outage Sunday evening and traced it to compromised PLCs on two water towers and 14 sewer lift stations, which the city then pulled off the cellular network.

This all comes as the United States has escalated attacks on Iran over the last two weeks, targeting bridges, water plants, energy facilities, and a key port. In response, Iran vowed to target critical infrastructure in the Middle East and issued veiled threats against US systems.