Trump Blames Governor, Not Iran, for Cyberattacks on 30+ Water Systems

For cybersecurity professionals, the most alarming element isn't the political blame game—it's the targeting of industrial control systems across 30+ water utilities in a single weekend. Attackers probed programmable logic controllers (PLCs), the very devices that manage physical water treatment, signaling a coordinated effort to map critical infrastructure. This story matters because it exposes the dangerous intersection of OT vulnerabilities and politicized incident response, which could delay technical containment and erode trust in federal threat intelligence.

In a stark departure from established cyber attribution norms, President Donald Trump publicly dismissed intelligence assessments linking recent cyberattacks on Minnesota’s water infrastructure to Iran, instead blaming state leadership and Democratic Governor Tim Walz for the breaches. Speaking at a Cabinet meeting on July 31, 2026, Trump rejected preliminary findings from U.S. officials and directly contradicted reports from the New York Times and ABC News, stating, “I don’t think so. I think I blame it on Minnesota because they’re grossly incompetent.” The incident targeted more than 30 water systems over the previous weekend, specifically exploiting programmable logic controllers (PLCs) used for remote monitoring and control—a classic industrial control system (ICS) attack surface that has drawn increasing attention from nation-state actors and cybercriminals alike.

“

officials and directly contradicted reports from the New York Times and ABC News, stating, “I don’t think so.

The political flare-up comes at a moment of heightened geopolitical risk, with the U.S. and Israel engaged in a military conflict against Iran. Cyberattacks on critical infrastructure have long been a tool of statecraft, and water utilities have been a frequent target for both espionage and sabotage. The attack on Minnesota’s systems follows a well-documented pattern of Iranian-linked groups, such as APT33 and APT34, probing water and energy sectors globally. Intelligence officials, speaking anonymously to the New York Times, indicated that Iranian hackers were likely responsible. Yet Trump’s outright rejection of this assessment—publicly airing his long-standing skepticism of the intelligence community—introduces a dangerous politicization of incident response. When attribution becomes a partisan weapon, it undermines the credibility of federal cybersecurity efforts and erodes the trust necessary for coordinated defense across states.

Governor Walz fired back on social media, asserting that Trump “knows exactly who is responsible” and highlighting that “DOGE took an axe to CISA and left the U.S. exposed to cyber attacks.” This reference to budget cuts at the Cybersecurity and Infrastructure Security Agency (CISA) points to a concrete operational concern: diminished federal capacity to assist state and local entities with cyber threat hunting, vulnerability management, and incident coordination. The clash exposes a policy fissure where the very agency designed to safeguard critical infrastructure has been weakened, even as attacks surge. Walz praised Minnesota’s own IT experts for quickly identifying the vulnerability and working with local communities to stop the intrusion, suggesting that states may increasingly have to rely on their own resources in the absence of robust federal support.