Trump Blames Minnesota, Not Iran, for Cyberattacks on Water Systems

President Trump said on Friday that he does not believe Iran was behind the cyberattacks on more than 30 Minnesota water systems and blamed the state instead. “I don’t think so. I blame it on Minnesota because they’re grossly incompetent,” Trump said at a Cabinet meeting at Camp David, according to KSTP. He added that “Iran’s got bigger problems than worrying about Minnesota.”

The president’s comments run against reporting from the past two days. The Washington Post reported Friday that U.S. intelligence agencies assessed Iran was likely behind the coordinated attack, citing U.S. officials, and the New York Times reported the same on Thursday. The Times described the assessment as preliminary, the Post said agencies have not definitively concluded Iran is responsible, and the FBI is still investigating. ABC News reported that multiple U.S. officials said the attacks may be linked to Iran and that there has been no formal attribution. Officials cited the lack of a ransom demand and the disruptive nature of the intrusions as factors pointing toward Tehran, Straight Arrow News reported. Nextgov reported that a water-sector memo said the attacks were aligned with an Iran-linked campaign described by federal cybersecurity officials in April but offered no direct evidence tying this incident to Iran.

Trump went on to say that Gov. Tim Walz, a Democrat, was responsible and called him “corrupt,” and said Vice President JD Vance had found “tremendous corruption in Minnesota,” KSTP reported. He did not say whether he had received intelligence from federal investigators about the attacks. Walz, writing on social media, said Trump “knows exactly who is responsible” and that other states were hit too. He also said the episode showed “what modern warfare looks like” and blamed federal cuts to the cybersecurity agency. KSTP noted that Trump has frequently targeted Minnesota and its leaders.

The practical questions are about how the systems were exposed. The attackers went after programmable logic controllers, industrial devices that run pumps, sensors and alarms. Kurt Gaudette, head of intelligence at the security firm Dragos, told the Washington Post that the attacks have gone after small utilities whose controllers are exposed to the internet and use default passwords: “It’s very low-hanging fruit.” Joe Slowik of the security firm Dataminr told the Post that he attributes the Minnesota incident and other attacks to Iran’s Revolutionary Guard cyber command; that is his assessment, not an official finding.

Local officials describe limited disruption. In Braham, about 65 miles north of Minneapolis, Mayor Nate George, a Republican running for state auditor, said crews isolated the affected system, restored a backup and restarted the plant in about 90 minutes while residents drew from the water tower, according to the Post and Straight Arrow News. In Plymouth, the public works director said devices controlling water and sewer operations were hacked and taken offline, then restored, with no effect on the water supply. Maple Plain and South St. Paul also acknowledged being affected, KSTP reported, and switched to backup plans.

The FBI’s Minneapolis office said Friday that threat actors were remotely accessing internet-facing controllers and changing IP addresses, KSTP reported. The FBI, the Cybersecurity and Infrastructure Security Agency and the Department of Homeland Security have warned of a significant increase in such activity across water systems, and, Straight Arrow News reported, Minnesota’s chief information security officer told the New York Times that similar activity has likely occurred elsewhere. The United States has been at war with Iran since Feb. 28.