President Donald Trump on Friday dismissed the possibility that Iran was behind a cyberattack that struck dozens of Minnesota municipal water systems this week, instead pointing blame at the state itself, even as federal and state investigators have said the tradecraft used points toward Tehran. “No, I think Minnesota is behind this,” Trump told reporters at a Cabinet meeting when asked directly whether he could rule out Iranian involvement. “You know whose behind this? Minnesota because they are grossly incompetent.”
The cyberattack targeted roughly 36 municipal water systems across Minnesota, according to John Israel, the state’s chief information security officer, who said the breach was first detected the previous Sunday. Hackers targeted infrastructure used to remotely manage and monitor water towers maintained by local governments, temporarily knocking a well and treatment plant offline in at least one city and forcing others to rely on manual workarounds.
There were no indications that any water supply had been rendered unsafe to drink, officials said, and Israel noted that as of midweek there had been no sign that any of the breaches contaminated or disrupted water delivery. Even so, cybersecurity experts have said the incident should be taken seriously given how old and underfunded many U.S. water systems remain, leaving them vulnerable to digital disruption.
Three state officials briefed on the investigation, speaking anonymously because it remains an active criminal matter, said the methods used and the absence of any ransom demand had led analysts to tentatively conclude the attack was the work of Iranian hackers. Investigators cautioned, however, that the assessment was preliminary and could change as more technical data is collected.
A former senior FBI official who previously oversaw investigations into state-sponsored cyberattacks said that in her experience, initial attribution assessments tend to hold up. She pointed to several details consistent with Iranian involvement, including that the attack appeared aimed at causing disruption rather than extracting a ransom, and that Tehran has recently shown a demonstrated interest in targeting American water infrastructure.
That interest has been documented by federal authorities. The Cybersecurity and Infrastructure Security Agency issued an advisory just days before the Minnesota attack began, warning that Iranian-affiliated hackers were attempting to break into operational technology used in critical infrastructure, including water and wastewater systems, according to the agency’s acting director, who said this week that CISA was tracking “multiple potential incidents affecting local water utilities” without directly naming a culprit.
Iran has escalated its cyber activity against the United States since the war between the two countries began in February, though with limited success in most cases. One notable exception came in March, when a hack attributed to Iranian actors forced a companywide shutdown at Stryker, a major medical equipment supplier. A group affiliated with Iranian intelligence also claimed responsibility for leaking emails and photos stolen from a personal account belonging to FBI Director Kash Patel.
Despite that pattern, Trump used his Cabinet meeting remarks to reject the Iran theory outright and instead train his criticism on Minnesota’s state government, which he has repeatedly clashed with. “I don’t think there was an Iranian cyber attack. I think that Minnesota needs to get its act together. It’s one of the worst run states,” Trump said, adding that Vice President JD Vance would back him up on the assessment.
Trump went further, suggesting undisclosed findings against the state were forthcoming without offering specifics. “By the way, massive future things having to do with corruption in Minnesota are happening right now,” he said, before moving on from the topic. Earlier in the same meeting, during his opening remarks, Trump had previewed the same message, telling attendees that officials “blamed it on Iran” but that “I don’t think so,” and that instead “I blame Minnesota and the governor, the corrupt governor of Minnesota.”
He dismissed the notion that Iran would even be capable of, or interested in, targeting Minnesota specifically given the state of the broader war. “Iran should be so lucky,” Trump said. “Iran’s got bigger problems than worrying about Minnesota.”
The remarks came against the backdrop of a broader ongoing dispute between the administration and Minnesota’s Democratic leadership, which Trump has accused of mismanagement on issues ranging from public safety to spending. His comments Friday extended that pattern to a cybersecurity incident that federal investigators, by their own account, have not yet definitively attributed to any single actor.
Local officials in Minnesota have framed the episode differently, casting it as a warning about the fragility of aging public infrastructure rather than a matter of state incompetence. The mayor of Braham, a small city roughly 65 miles north of Minneapolis, said public works staff detected a malfunction at the well feeding the city’s water tower early in the week and isolated the affected system within about 90 minutes, restoring a backup and briefly urging residents to conserve water before lifting the advisory.
“This attack on critical public infrastructure should be a warning to policymakers in St. Paul,” the mayor said in a statement, adding that local governments are expected to defend essential systems against foreign adversaries and sophisticated criminals, often while working with limited staff, aging technology and inadequate resources.
The FBI has said it is aware of the incident and is in contact with the affected utilities to help resolve the matter, though the bureau has declined to comment further on attribution while the investigation continues. Investigators have said they expect suspicion of Iranian involvement to firm up, not fade, as the inquiry proceeds, even as the president has publicly staked out a contrary position.
Trump’s remarks marked one of the more direct instances of the president publicly diverging from the preliminary assessment of his own government’s investigators, who as of Thursday had not ruled Iran out and, according to several officials familiar with the inquiry, viewed it as the leading explanation.