Minnesota Governor Tim Walz accused President Donald Trump on Friday of knowingly concealing the true source of a sweeping cyberattack on U.S. municipal water systems, arguing that the president’s public dismissal of Iran as a suspect was less about the facts of the case and more about avoiding an inconvenient truth: that Washington has no strategy for winning its ongoing war with Tehran.
The exchange began earlier Friday when Trump, speaking to reporters during a televised Cabinet meeting at Camp David, rejected the assessment of federal and state investigators who have pointed toward Iranian-linked hackers as the likely culprits behind a cyberattack that struck more than 30 municipal water systems across Minnesota. Trump instead placed blame on the state itself and, by extension, on Walz.
Walz responded directly on X roughly three hours later, writing in full: “Trump knows exactly who is responsible for this attack, and knows that other states were hit too. This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran.” The post was published at 11:56 a.m. on July 31, 2026.
Walz Ties the Hack to Trump’s Cuts at CISA
In a follow-up comment posted underneath that message, Walz went further, connecting the vulnerability exploited by the hackers to staffing and funding reductions made under the Department of Government Efficiency. “DOGE took an axe to CISA and left the U.S. exposed to cyber attacks,” Walz wrote. “Thankfully, our experts in Minnesota were able to identify the vulnerability quickly and work with local communities to stop it.”
Roughly two hours later, at 1:50 p.m., Walz posted again, this time framing the episode as evidence that the administration’s domestic political feuds were undermining its ability to confront Iran on the world stage. “Trump can’t beat Iran because he’s too busy waging war with Minnesota,” Walz wrote.
What Trump Said That Triggered the Response
Walz’s posts were a direct response to remarks Trump made earlier Friday, when a reporter asked him whether he could rule out Iranian involvement in the water system breach. “No, I think Minnesota is behind this,” Trump said. “You know whose behind this? Minnesota because they are grossly incompetent.” He continued in that vein throughout the meeting, telling attendees that officials had “blamed it on Iran” but that he did not believe it, adding, “I blame Minnesota and the governor, the corrupt governor of Minnesota.” Trump also dismissed the idea that Iran would have reason to target Minnesota given the broader state of the war, saying, “Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota.” He offered no evidence for the claim that Minnesota was responsible for a cyberattack on its own infrastructure, and separately said Vice President JD Vance had brought him a report describing “massive future things having to do with corruption in Minnesota.”
The Scale of the Attack
The cyberattack Trump was addressing struck at least 30 municipal water systems in Minnesota beginning the night of Sunday, July 26, and continuing into Monday, July 27, according to Minnesota IT Services and John Israel, the state’s chief information security officer. Hackers targeted programmable logic controllers, the internet-facing equipment used to remotely monitor and control water pressure, chemical dosing and other safety functions at treatment plants and water towers. At least one city’s well and treatment plant were temporarily knocked offline, forcing staff to switch to manual operation, though state officials said there was no indication that any drinking water had been contaminated or rendered unsafe.
The Minnesota Bureau of Criminal Apprehension, in a memo distributed to law enforcement this week, assessed that the hackers’ likely goal was to cause a loss of system pressure and the potential contamination of the water supply. State officials cautioned that formal attribution had not been completed and that they remained wary of false-flag tactics, even as multiple officials familiar with the investigation said the tradecraft involved was consistent with a campaign linked to Iran.
Iran Emerges as the Leading Suspect, Even as Trump Casts Doubt
The New York Times first reported that U.S. and state officials believed Iranian hackers were probably behind the intrusion, a conclusion also referenced in a memo from the Minnesota Fusion Center describing the late-July hacks as “aligned” with a broader Iran-linked cybersabotage campaign. The Cybersecurity and Infrastructure Security Agency had warned in an advisory issued just days before the attack began that Iranian-affiliated hackers were actively attempting to breach operational technology in the water and wastewater sector. A former senior FBI official who previously led investigations into state-sponsored hacking said that in her experience, early attribution assessments of this kind tend to hold up, pointing to the attackers’ apparent focus on disruption rather than ransom, along with Iran’s documented recent interest in targeting American water infrastructure.
That interest has a track record. Since the war between the United States and Iran began in February, Iranian-linked actors have escalated cyber operations against American targets, including a hack in March that forced a companywide shutdown at medical equipment supplier Stryker and a separate breach in which a group affiliated with Iranian intelligence claimed responsibility for leaking material from a personal account belonging to FBI Director Kash Patel.
Attack Spread to Multiple States, FBI Says
The Minnesota breach was not an isolated event. The FBI said this week that cyberattacks targeting municipal water systems have now been reported in at least seven states, and the FBI’s Minneapolis field office issued a public service announcement Thursday warning that malicious actors are remotely accessing internet-facing controllers, altering IP configurations and locking operators out of their own systems. Wisconsin’s Department of Natural Resources confirmed it detected related malicious activity at water facilities on Monday and urged utilities statewide to take “immediate action to prevent potentially serious impacts to our systems.” CISA, in its own advisory, said hackers “are targeting water entities of all sizes” and urged operators to disconnect vulnerable equipment from the internet.
Experts Warn of a Chronically Underfunded Sector
Cybersecurity specialists who monitor the water sector said the coordinated nature of the attacks marked an escalation. Gus Serino, a longtime cybersecurity specialist focused on water infrastructure, told CNN that the scale and coordination of the recent attacks on Minnesota suppliers was “unprecedented,” and said the incidents again demonstrated that many utilities still rely on systems that lack basic protections capable of stopping this kind of intrusion. Joshua Corman, co-founder of the volunteer cybersecurity group I Am The Cavalry, said the growing number of water-system compromises was “deeply concerning” given how quickly hospitals and other essential services depend on a functioning water supply, and questioned whether remote connectivity built for convenience had become a liability utilities can no longer justify.
A Familiar Political Fight
Friday’s dispute unfolded against the backdrop of a long-running feud between Trump and Walz that predates the current war. The two have clashed repeatedly since the 2024 election, when Walz served as the Democratic vice presidential nominee, and tensions deepened after the Justice Department alleged in December that as much as half of $18 billion in federal funds spent on 14 Minnesota-run programs — including child nutrition, housing and autism services — may have been stolen through fraud. Walz has not been accused of personally participating in that alleged fraud, but Trump has repeatedly invoked it, along with the broader claim that Minnesota is mismanaged, in public remarks about the state.
It is not the first time Walz has had to respond to a major cyberattack on Minnesota infrastructure. In July 2025, Walz activated the Minnesota National Guard’s cyber forces and declared a state of emergency after a “deliberate, coordinated, digital attack” disrupted city services in Saint Paul, an incident his office said exceeded the city’s own response capabilities.
Local Officials Frame It as an Infrastructure Warning, Not a Scandal
Local leaders in Minnesota have described the episode in starkly different terms than the president. The mayor of Braham, a small city roughly 65 miles north of Minneapolis, said public works staff detected a malfunction at the well feeding the city’s water tower early in the week and isolated the affected system within about 90 minutes, restoring service from a backup source after briefly urging residents to conserve water. “This attack on critical public infrastructure should be a warning to policymakers in St. Paul,” the mayor said in a statement, adding that local governments are expected to defend against foreign adversaries and sophisticated criminals despite limited staff, aging technology and inadequate resources.
Where the Investigation Stands
As of Friday, no U.S. agency had formally attributed the water-system intrusions to any single actor, and the FBI has said only that it is coordinating with affected utilities while the inquiry continues. Investigators involved in the case have told reporters they expect suspicion of Iranian involvement to firm up rather than fade as more technical evidence is analyzed, even as Trump has continued to publicly stake out a contrary position — one that puts him at odds with the preliminary findings of his own administration’s investigators.