Trump Rejects Iran Assessment in Minnesota Water Hacks, Blames Walz Without Evidence

More than 30 water systems in Minnesota were targeted through their operating technology, the layer of software and controls that helps move treated drinking water to homes, schools and hospitals ⁶⁹. That number is what gives this story its weight, because it is not one failed password at one utility or one small town dealing with a glitch. It is dozens of separate systems across one state reporting intrusions in the same week, including the system serving Plymouth, a large suburb west of Minneapolis ⁶⁹. Residents were not told that their taps were poisoned or that water had stopped flowing, but they were left with a more unsettling fact: the machinery behind their drinking water had been reached by someone, and no one in public had named who did it ⁶⁹.

State officials reported the Minnesota attacks earlier in the week of July 30, 2026, with a photograph of the Plymouth water tower dated Thursday, July 30, marking when the breach became public ⁹. The systems involved were described as water systems compromised at the operational level, not merely office email or billing networks, which is why state leaders and federal investigators treated the incident as a public-safety matter rather than a routine IT problem ⁶⁹. Minnesota took the initial step of notifying federal authorities, setting in motion an FBI investigation that remains open and without a publicly identified culprit ⁶⁹. At that stage, the basic outline was familiar from other critical-infrastructure incidents: local operators spot anomalies, the state reports upward, and federal agencies assess whether a foreign actor is involved ⁵³.

American intelligence agencies believe Iran is behind the Minnesota attacks, according to the reporting file, and federal investigators have assessed that the operation may be linked to Iran or its proxy groups ⁵³. That assessment does not amount to a formal public attribution, and authorities have been careful to say the FBI is still investigating and has not publicly identified who is responsible ⁶⁹. But it is a substantive judgment from the agencies whose job is to trace campaigns against U.S. infrastructure, and it shaped how the incident was first understood in Washington and in Minnesota ³⁵. Experts cited in Minnesota coverage also pointed toward Iran, a reading consistent with past Iranian interest in probing U.S. water and industrial controls ⁵.

On Friday, July 31, 2026, at a Cabinet meeting at Camp David, Maryland, President Donald Trump publicly rejected that assessment ²¹¹. He questioned whether Iran was behind the attacks and instead blamed Minnesota and Gov. Tim Walz, whom he described as grossly incompetent ²³⁴¹¹. The setting mattered. A Cabinet meeting at the presidential retreat is a stage chosen to project control and unity, and Trump used it to draw a clean line between his own conclusion and that of his intelligence agencies and investigators ²¹¹. While federal investigators pointed toward a foreign adversary, the president pointed toward state officials in Minnesota ³⁵.

Trump offered no specific evidence to support his claim that Minnesota and Walz were responsible for the breach, a point noted across multiple outlets covering the remarks ³⁴¹⁰. The research file is explicit on this: sources agree on the core facts, none provide evidence for Trump's assignment of blame to Walz, and none dispute that the federal Iran assessment exists and remains under investigation ³⁴¹⁰. That absence of evidence does not by itself resolve who conducted the attacks, because the FBI has not made a public attribution either ⁶⁹. But it does define the president's intervention for what it was: a direct contradiction of his own agencies without supporting material presented to the public ³⁴.

Gov. Tim Walz rejected Trump's comments outright and fired back, according to IBTimes UK, which describes the exchange as an open clash between the president and the Minnesota governor ¹⁰. The caption for the broadcast also records Walz rejecting the president's comments outright ¹⁰. The details of Walz's response beyond that rejection are not elaborated in the research memo, but the political shape is clear. Minnesota reported an attack on its infrastructure and sought federal help, then found its governor singled out by the president as the cause ¹⁰³. For a state emergency-management system built on the assumption that Washington will help diagnose a foreign intrusion, that reversal landed as both an insult and a practical complication ³¹⁰.

By Saturday, August 1, the geography of the incident had grown. Michigan joined Minnesota in reporting cyberattacks on its water systems, nine of them, with the FBI investigating that second cluster as well ⁶⁹. ABC News sources also reported that Georgia and Michigan were reporting similar cyberattacks, suggesting investigators were looking at a possible multi-state pattern rather than an isolated Minnesota event ². The expansion did not bring a public attribution. The FBI investigation continued, and authorities still had not publicly identified a culprit ⁶⁹. If the additional reports are confirmed as part of the same campaign, they would strengthen the case that this was a coordinated effort against water-sector operating technology rather than coincidental failures in different states ²⁶.

What remains unresolved is the central question of attribution, and it is not academic. Water operators need to know what they are defending against: opportunistic intrusion enabled by weak passwords and unpatched remote access, or a deliberate campaign by a state-linked actor testing how far it can get into American operating technology ⁵⁶. The intelligence assessment pointing to Iran implies the latter, with implications for how utilities isolate control systems, monitor vendor access, and share indicators across state lines ⁵³. The president's claim of state incompetence implies the former, but without evidence or technical detail, it gives operators nothing to patch, block or investigate ³⁴¹⁰. In that sense, the public dispute itself has a cost, because every day spent arguing about who to blame without sharing findings is a day utilities must defend without a clear threat picture ⁶⁹.

The record as it stands is therefore split in a way rarely seen so openly. On one side are American intelligence agencies and federal investigators who believe Iran is behind the Minnesota attacks and assess a possible link to Iran or its proxies, while the FBI continues to investigate without a public identification ⁵³⁶⁹. On the other side is the president, who says Iran was not responsible, who faults Minnesota and Walz, and who has provided no evidence for that alternative ²³⁴¹¹. A reader who never watches the broadcast should understand that both claims cannot be true at the same time, and that only one of them currently carries the institutional weight of an intelligence assessment, incomplete as it is ³⁵¹⁰. The other carries the weight of the presidency, but no supporting proof disclosed to the public ³⁴.

Whether the federal investigation will produce a public attribution, and whether that attribution aligns with the investigators' early assessment or with the president's dismissal of it, is now the test to watch ⁶⁹¹⁰. If the FBI and intelligence agencies present technical evidence linking the intrusions to Iran or its proxies, Trump will have to explain why he rejected his own agencies at Camp David ³¹¹. If investigators conclude the cause was poor cyber hygiene or an unrelated actor, the president's skepticism will look more prescient, though still unsupported at the time he voiced it ³⁴. And if investigators say nothing further, the public will be left with the worst outcome: more than 30 compromised water systems in one state, nine more reported in another, and a national argument about competence that never answered who got inside the controls that deliver drinking water ⁶⁹¹⁰.