President Trump pointed the finger at Minnesota Gov. Tim Walz, not Iran, for a wave of cyberattacks that hit more than 30 of the state's water systems, even as federal agencies warned the campaign may stretch across at least seven states.
Trump made the claim Friday at a Cabinet meeting at Camp David in Thurmont, Maryland, dismissing the possibility of foreign involvement and instead calling Minnesota's leadership "grossly incompetent." He offered no evidence for the assertion, ABC News reported.
The statement landed while multiple federal agencies, the FBI, the Environmental Protection Agency, and the Cybersecurity and Infrastructure Security Agency, were actively investigating whether Iran or Iran-linked hackers orchestrated the attacks. U.S. officials had already briefed state and local leaders in Minnesota about a possible Iranian connection, and CISA had issued a formal alert the day before warning that hackers were targeting the industrial controllers that run water-treatment equipment nationwide.
Minnesota IT Services, the state's technology agency, reported that more than 30 community water systems were hit on Sunday and Monday. The attackers went after systems used to remotely monitor and control equipment, specifically, programmable logic controllers, the hardware that manages physical operations like pumps, valves, and switches.
CISA's Thursday alert warned that hackers were modifying passwords on those controllers "to lock out operators." The effect: local water staff could lose the ability to manage their own equipment remotely.
In at least one case, the disruption was immediate. The city of Braham, a small Minnesota community, asked residents to minimize water use for several hours after its water plant went offline, AP News reported. Other communities experienced brief disruptions, though no residents were reported to have suffered water-quality problems or long-term service loss.
Minnesota IT Services said it had not determined who was responsible. It added that there were no active requests for residents to change their water use and that it was working with federal investigators.
Sen. Amy Klobuchar, a Minnesota Democrat, said she spoke with U.S. National Cyber Director Sean Cairncross about the attacks. She said Cairncross "confirmed that at this point there are no effects on services." In a written statement Friday, Klobuchar added:
"Director Cairncross and I discussed updated technology, recognizing that resources are an issue for so many communities, not just in Minnesota but across the country."
Minnesota was not alone. On Thursday, the FBI and EPA issued a nationwide warning that at least seven states beyond Minnesota had reported incidents on their water systems. Georgia and Michigan were among them.
Michigan's State Police Emergency Management and Homeland Security Division received a public service announcement from the FBI warning of the cyberattack campaign and distributed it statewide. Nine reports were subsequently filed with the Michigan Department of Environment, Great Lakes, and Energy detailing incidents matching the FBI's description.
Cybersecurity experts said the scope of the campaign pointed squarely at a state-sponsored actor. Annie Fixler of the Foundation for Defense of Democracies, a national security think tank, told the New York Post that Iranian threat actors were the working assumption:
"The working assumption is that it is Iranian threat actors. The kind of behavior matches what we've seen out of Iran. The kind of targets and the systems that we're talking about match."
Fixler warned the real number of affected states was likely higher. "If it's seven, there's no reason to think it stops there. The FBI is saying at least seven. I'm sure it's larger than that," she said. She noted that the hackers bypassed multiple network security layers to reach the operational technology that controls physical infrastructure, a technique consistent with prior Iranian campaigns against water and wastewater systems.
Cynthia Kaiser, a former FBI cyber division deputy assistant director, echoed that assessment. "I think most credible researchers and responders would be right to treat it like it's Iran until proven otherwise," Kaiser told AP News. "When it walks like a duck and talks like a duck, it's really important to call it out."
The FBI itself issued a more measured statement Friday, telling ABC News it was "aware of recent public reporting around Water and Wastewater sectors" and that "the FBI and our interagency partners are fully engaged to protect critical infrastructure and we remain well-equipped to protect against cyber threats of all varieties."
Gov. Walz responded to Trump's comments on social media Friday, directly challenging the president's framing. Walz wrote:
"Trump knows exactly who is responsible for this attack, and knows that other states were hit too. This is what modern warfare looks like, and it further illustrates there's no plan to win a war with Iran."
In a separate post, Walz blamed federal spending cuts for weakening the nation's cyber defenses:
"DOGE took an axe to CISA and left the U.S. exposed to cyber attacks. Thankfully, our experts in Minnesota were able to identify the vulnerability quickly and work with local communities to stop it."
Walz's claim about DOGE, the Department of Government Efficiency, cutting into CISA's capacity was not corroborated by any federal agency statement in the available reporting. No specific cuts were identified. But the accusation fit a broader Democratic talking point that federal restructuring has left agencies stretched thin at a moment when critical infrastructure faces escalating foreign threats.
The FBI, CISA, and other agencies had previously warned in an advisory that Iranian hackers were targeting water and wastewater systems along with other critical infrastructure. That prior warning gave federal investigators a head start when the Minnesota attacks surfaced, and made Trump's public dismissal of the Iran angle all the more notable.
No federal agency has formally attributed the Minnesota attacks to a specific actor. The investigation remains open. But the pattern, targeting small-town water utilities through industrial controllers, locking out operators, hitting multiple states simultaneously, matches what cybersecurity professionals and former federal officials describe as an Iranian playbook.
The attacks caused disruptions including password changes, loss of water pressure, and localized flooding, though authorities said there was no current threat to water safety or contamination. The operational status of all 30-plus affected Minnesota systems remains unclear.
Several questions remain unanswered. Which seven additional states reported incidents? What specific evidence links the campaign to Iran? And did Cairncross, the national cyber director, make any direct public statement, or is his assessment known only through Klobuchar's characterization?
When foreign hackers target American water systems across multiple states and federal investigators are tracking a hostile nation's fingerprints, the country needs its leaders focused on the adversary, not on scoring points against a governor from the other party.
