President Donald Trump has attributed recent cyberattacks on water systems to the state of Minnesota, contradicting assessments from U.S. intelligence agencies and cybersecurity experts who largely point to Iran. Trump stated on Friday, July 31, 2026, that Minnesota was "grossly incompetent" and "behind it," dismissing the idea of an Iranian cyberattack. The White House did not provide clarification when asked about the president's remarks or who he believed was responsible for similar attacks in other states.
This stance diverges from conclusions reached by federal investigators, including the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI, which have attributed the activity to Iranian-affiliated cyber actors. CISA had recently updated an advisory, AA26-097A, detailing how Iranian hackers were targeting programmable logic controllers (PLCs) in the water sector and other critical infrastructure. The Water Information Sharing and Analysis Center (WaterISAC) confirmed its confidence in the government's assessment, citing evidence of prior Iranian attacks and the alignment of current activity with CISA's warnings.
Cybersecurity professionals swiftly pushed back against the president's comments. Experts noted that victim-blaming is an outdated approach in cybersecurity and highlighted the inconsistency with intelligence community findings. They emphasized that attribution is a complex process, but the technical indicators, historical patterns of Iranian activity, and the geopolitical context of an ongoing conflict with Iran all strongly suggest Iranian involvement. Some analysts described the attacks as "targets of opportunity," where hackers exploited vulnerabilities rather than specifically targeting Minnesota.
Minnesota Governor Tim Walz, a Democrat who ran as the vice-presidential nominee against Trump in 2024, responded to the president's remarks on Facebook. Walz accused Trump of knowing the true perpetrators and highlighted that other states were also affected. He linked the attacks to what he called a lack of a plan for the war with Iran and criticized the Trump administration's Department of Government Efficiency (DOGE) for reducing CISA's resources, leaving the U.S. vulnerable. Walz asserted that Minnesota's experts had successfully identified vulnerabilities and collaborated with local communities to mitigate the impact.
A spokesperson for Minnesota IT Services, Emily Zimmer, declined to comment directly on Trump's political statements or speculate on attribution. The agency stated its focus remains on supporting affected communities, securing critical infrastructure, and coordinating with local and federal officials during the ongoing investigation.
The water sector is frequently identified as one of the most vulnerable critical infrastructure sectors. Experts have called for increased funding to bolster its cybersecurity defenses. President Trump has previously expressed skepticism regarding his own government's attribution of cyberattacks, notably questioning the assessment that Russia was behind the SolarWinds breach, instead suggesting China.
