President Donald Trump brushed off reports that Iran-linked hackers targeted Minnesota water systems and instead pointed the finger at the state’s Democratic governor.
At a Cabinet meeting at Camp David, Trump dismissed the idea that Tehran was behind the cyberattack that hit municipal water systems across Minnesota and used the moment to unload on Gov. Tim Walz.
“I think Minnesota is behind it. Do you know who’s behind it? Minnesota, because they’re grossly incompetent. I think the governor’s behind it,” Trump said.
“I don’t think there was an Iranian cyber attack. I think that Minnesota ought to get its act together. It’s one of the worst-run states.”
Trump kept going, mocking the Iran explanation directly.
Q: Can you rule out that Iran is behind that cyber attack?
Trump: No, I think Minnesota is behind it. I don’t think there was an Iranian cyber attack. pic.twitter.com/4dk8aFXmbv
— Acyn (@Acyn) July 31, 2026
“They like to say, ‘Oh, it was Iran.’ Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota,” he added.
Walz shot back on X, accusing Trump of knowing more than he was admitting and arguing that the incident showed how exposed the country had become to cyberwarfare.
The former Vice Presidential candidate argued that Trump knew who was responsible and that other states had also been hit.
🎇Honor America’s 250th Anniversary!!!🎇 Get your 2026 Heritage Foundation commemorative membership card ➡️➡️➡️ ACTIVATE YOUR MEMBERSHIP NOW!!! 🇺🇸🇺🇸🇺🇸
“This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran,” Walz said.
The Minnesota governor then turned the blame toward Washington, arguing that cuts to federal cyber defenses had left the U.S. vulnerable.
He blamed DOGE for weakening federal cyber defenses.
“DOGE took an axe to CISA and left the U.S. exposed to cyber attacks,” Walz added. “Thankfully, our experts in Minnesota were able to identify the vulnerability quickly and work with local communities to stop it.”
The targets were municipal water systems, more than 30 of them in Minnesota, and multiple outlets reported that the hackers were believed to be backed by Iran.
Minnesota’s technology agency treated the intrusion as serious from the start. Minnesota IT Services said operational technology was targeted during a “coordinated cyberattack” over July 26 and 27, setting off the state’s incident-response protocols.
The Washington Post reported that the known disruption was limited, but still hit real operations. One water system briefly lost service, and remote sensors were disrupted at another.
The outlet reported that no drinking water had been found unsafe.
Israel framed the response as a government-wide effort to help communities get systems back in order and prepare for more attempts.
“Cyberattacks against critical infrastructure require a coordinated, whole-of-government response,” Israel said, adding that MNIT was working with partners to help affected utilities recover and strengthen defenses.
The same week Minnesota disclosed the attack, federal cyber officials were telling water and wastewater operators to get exposed equipment offline.
CISA’s warning focused on programmable logic controllers, or PLCs, after outside actors changed passwords and locked out operators.
The agency urged utilities to disconnect PLCs and other operational technology from the internet as soon as possible.
“This activity has resulted in boil water notices and sustained manual operations,” CISA said.
The recommended fixes were basic. CISA also recommended safeguards such as turning on password protections and replacing default passwords.
The federal warning stopped short of naming Minnesota or Iran. ABC News reported that U.S. officials were still examining whether the hostile regime was responsible for the cyberattacks.
CBS News reported that investigators were also examining possible Iranian involvement, while intelligence officials waited for more forensic evidence.
Another possibility remained on the table, according to officials: someone else could have been posing as Iran to inflame tensions during the U.S. conflict with the regime.
The FBI was also probing the matter, The Washington Post reported.
If Tehran is confirmed as the culprit, the Minnesota hacks would carry bigger stakes.
The Post reported that Iranian involvement could mark a serious escalation in Tehran’s campaign against U.S. critical infrastructure.
Slowik, the Dataminr threat research director, told the Post the country had already been seeing disruptions beyond one sector.
“It is not a secret that these things have been taking place since the spring,” Slowik said.
“There have been disruptions in multiple critical infrastructure sectors. It’s a big deal.”
The dispute soon pulled in other Democrats, including Sen. Jeanne Shaheen of New Hampshire, who criticized Trump during a Friday appearance on MS NOW’s “On the Line.”
“It’s typical of the way Donald Trump responds. He doesn’t seem to appreciate the threat to our own national security,” Shaheen said.
Shaheen accused Trump of siding with a hostile foreign power while officials were still investigating the cyberattack.
“It’s egregious for the President of the United States to take the side of a sworn enemy of the United States over a state in this country,” she added.
