President Trump dismissed Iranian responsibility for a coordinated cyberattack on more than 30 Minnesota water systems and pointed blame at Governor Tim Walz, calling him "corrupt" and "grossly incompetent."
Trump made the remarks Friday at the start of a Cabinet meeting at Camp David, days after malicious software disrupted automated operations at water facilities across Minnesota. The attack temporarily shut down controls for a well and water treatment plant in Braham and forced Plymouth and South St. Paul to shift some operations to manual control. Minnesota IT Services confirmed the breach targeted operational technology on Sunday and Monday but said it has not yet determined whether a "specific actor" was responsible. The investigation remains active.
The president's response reframed the incident as a failure of state governance rather than a foreign-policy crisis. While unnamed U.S. and state officials told the New York Times that Iranian hackers were likely behind the attack, Trump waved off that assessment and turned the spotlight on Walz's administration, a governor already weakened by fraud scandals and a decision to abandon his bid for a third term.
Fox News reported Trump's full remarks from the Cabinet meeting, where the president left little doubt about whom he held accountable:
"I just want to mention that we heard in Minnesota there was a cyberattack, and they blame it on Iran. I don't think so. I think I blame it on Minnesota because they're grossly incompetent."
He continued, escalating the attack on Walz directly:
"There was a cyberattack of 30 water plants, and I would blame it on Minnesota and the governor, the corrupt governor of Minnesota. They like to say, oh, is Iran? Iran should be so lucky. Iran's got bigger problems than worrying about Minnesota."
Trump's framing carried a specific political logic. Walz, the 2024 Democratic vice presidential nominee, abandoned his bid for a third term in January amid mounting scrutiny of his administration's handling of widespread fraud in state-administered social services programs. Walz has not been accused of participating in the fraud, but the scandals have dogged his tenure and raised questions about oversight failures under his watch.
Minnesota has faced broader scrutiny over accountability gaps in its state agencies. A Republican lawmaker has separately demanded records tied to the Feeding Our Future fraud case, one of the largest pandemic-era fraud schemes in the country, further underscoring concerns about how the state managed federal dollars.
Walz responded on X after Trump's Cabinet-meeting comments. His post accused the president of deflecting from a genuine national security threat:
"Trump knows exactly who is responsible for this attack, and knows that other states were hit too. This is what modern warfare looks like, and it further illustrates there's no plan to win a war with Iran."
Walz's claim that other states were also targeted is not corroborated elsewhere in available reporting. Fox News Digital reached out to Walz's office for comment but received no noted response.
The governor's post tried to pivot the story toward foreign policy and Iran tensions. But it also raised a question Walz did not answer: if the attack represented "modern warfare," what had his own state done to harden more than 30 community water systems against a threat that federal agencies had flagged days earlier?
Just days before the Minnesota attacks, federal agencies warned that Iranian-affiliated hackers were targeting computerized controls used by water systems, power facilities, and local governments. The warning noted that the hacking campaign had already disrupted operations at some facilities and caused financial losses. Investigators assessed the hackers were seeking to cause disruption inside the United States.
That warning did not arrive in a vacuum. Iranian-linked cyber intrusions against U.S. water infrastructure have a documented track record stretching back more than a decade.
In 2023, the Cybersecurity and Infrastructure Security Agency reported that hackers affiliated with Iran's Islamic Revolutionary Guard Corps breached programmable controllers at several U.S. water and wastewater facilities. Those hackers exploited equipment exposed to the internet that still used default or nonexistent passwords, a basic security failure. Affected utilities moved some operations offline, though no drinking water was compromised.
And in 2013, the Justice Department charged an Iranian hacker with repeatedly accessing the control system of a small dam in Rye, New York. Prosecutors said the intrusion would have allowed him to operate the dam's sluice gate remotely. The gate had been manually disconnected for maintenance at the time, a stroke of luck, not a layer of defense.
The pattern is clear enough: Iranian-linked actors have probed and breached U.S. water and infrastructure systems for years, and the vulnerabilities they exploit are often embarrassingly basic. That history lends weight to the preliminary assessments pointing toward Iran. It also makes the question of state-level preparedness harder for Walz to dodge.
Minnesota officials moved quickly to reassure residents. The Minnesota Department of Health said it was "not aware of any active requests from Minnesota cities to have their residents modify their drinking water usage." Officials in Braham, Plymouth, and South St. Paul reported no known threat to drinking water.
But the operational disruption was real. Malicious software temporarily shut down controls for Braham's well and water treatment plant. Plymouth and South St. Paul shifted some operations to manual control, meaning human operators had to step in where automated systems failed. For communities that depend on those systems running around the clock, even a temporary loss of automated control is serious.
Minnesota IT Services confirmed the scope of the attack in a public statement, describing a "coordinated cyberattack" that "targeted operational technology at more than 30 Minnesota community water systems." The agency said it has not determined whether a "specific actor" was responsible, and the probe remains active.
That careful language, "specific actor" still undetermined, stands in contrast to both Trump's confident dismissal of Iranian involvement and the preliminary assessments from unnamed officials pointing toward Tehran. Neither side has offered the public a definitive answer.
Trump's decision to blame Walz rather than Iran was as much political as it was strategic. Walz entered 2026 already diminished. His decision to drop out of the governor's race in January came as scrutiny intensified over how his administration handled fraud schemes that siphoned money from social services programs meant to help vulnerable Minnesotans.
The cyberattack gave Trump a fresh opening to frame Walz as a governor who could not manage basic state functions, let alone protect critical infrastructure from foreign adversaries. Whether or not Iran was behind the breach, the fact that more than 30 community water systems were vulnerable enough to be hit in a coordinated attack is a governance failure that falls on the state.
Democrats nationally are already navigating a difficult landscape. Mounting signs suggest their path to Senate control is narrowing, and episodes like this, where a Democratic governor is caught flat-footed on a basic security question, do nothing to help the party's credibility on competence.
The attribution question, Iran or someone else, may take weeks or months to resolve. Minnesota IT Services has not named a responsible actor. The preliminary assessments pointing toward Iran come from unnamed officials and remain unconfirmed. Trump has dismissed those assessments without offering an alternative explanation.
But the attribution debate, however it resolves, does not change the underlying facts. More than 30 community water systems in a single state were hit by a coordinated cyberattack. Automated controls went dark. Facilities scrambled to manual operation. Federal agencies had warned days earlier that exactly this kind of attack was coming.
Someone in Minnesota should have been ready. The question is whether anyone was.
When federal agencies send a warning and the state still gets caught off guard, blaming the hackers, whoever they are, only goes so far. At some point, the people responsible for keeping the lights on and the water running have to answer for why they didn't.