Trump Rejects Iran Assessment in Minnesota Water Hacks, Blames Walz Without Evidence

State officials reported the Minnesota attacks earlier in the week of July 30, 2026, with a photograph of the Plymouth water tower dated Thursday, July 30, marking when the breach became public⁠9. The systems involved were described as water systems compromised at the operational level, not merely office email or billing networks, which is why state leaders and federal investigators treated the incident as a public-safety matter rather than a routine IT problem⁠6⁠9. Minnesota took the initial step of notifying federal authorities, setting in motion an FBI investigation that remains open and without a publicly identified culprit⁠6⁠9. At that stage, the basic outline was familiar from other critical-infrastructure incidents: local operators spot anomalies, the state reports upward, and federal agencies assess whether a foreign actor is involved⁠5⁠3.

American intelligence agencies believe Iran is behind the Minnesota attacks, according to the reporting file, and federal investigators have assessed that the operation may be linked to Iran or its proxy groups⁠5⁠3. That assessment does not amount to a formal public attribution, and authorities have been careful to say the FBI is still investigating and has not publicly identified who is responsible⁠6⁠9. But it is a substantive judgment from the agencies whose job is to trace campaigns against U.S. infrastructure, and it shaped how the incident was first understood in Washington and in Minnesota⁠3⁠5. Experts cited in Minnesota coverage also pointed toward Iran, a reading consistent with past Iranian interest in probing U.S. water and industrial controls⁠5.

On Friday, July 31, 2026, at a Cabinet meeting at Camp David, Maryland, President Donald Trump publicly rejected that assessment⁠2⁠11. He questioned whether Iran was behind the attacks and instead blamed Minnesota and Gov. Tim Walz, whom he described as grossly incompetent⁠2⁠3⁠4⁠11. The setting mattered. A Cabinet meeting at the presidential retreat is a stage chosen to project control and unity, and Trump used it to draw a clean line between his own conclusion and that of his intelligence agencies and investigators⁠2⁠11. While federal investigators pointed toward a foreign adversary, the president pointed toward state officials in Minnesota⁠3⁠5.

Trump offered no specific evidence to support his claim that Minnesota and Walz were responsible for the breach, a point noted across multiple outlets covering the remarks⁠3⁠4⁠10. The research file is explicit on this: sources agree on the core facts, none provide evidence for Trump's assignment of blame to Walz, and none dispute that the federal Iran assessment exists and remains under investigation⁠3⁠4⁠10. That absence of evidence does not by itself resolve who conducted the attacks, because the FBI has not made a public attribution either⁠6⁠9. But it does define the president's intervention for what it was: a direct contradiction of his own agencies without supporting material presented to the public⁠3⁠4.

Gov. Tim Walz rejected Trump's comments outright and fired back, according to IBTimes UK, which describes the exchange as an open clash between the president and the Minnesota governor⁠10. The caption for the broadcast also records Walz rejecting the president's comments outright⁠10. The details of Walz's response beyond that rejection are not elaborated in the research memo, but the political shape is clear. Minnesota reported an attack on its infrastructure and sought federal help, then found its governor singled out by the president as the cause⁠10⁠3. For a state emergency-management system built on the assumption that Washington will help diagnose a foreign intrusion, that reversal landed as both an insult and a practical complication⁠3⁠10.

By Saturday, August 1, the geography of the incident had grown. Michigan joined Minnesota in reporting cyberattacks on its water systems, nine of them, with the FBI investigating that second cluster as well⁠6⁠9. ABC News sources also reported that Georgia and Michigan were reporting similar cyberattacks, suggesting investigators were looking at a possible multi-state pattern rather than an isolated Minnesota event⁠2. The expansion did not bring a public attribution. The FBI investigation continued, and authorities still had not publicly identified a culprit⁠6⁠9. If the additional reports are confirmed as part of the same campaign, they would strengthen the case that this was a coordinated effort against water-sector operating technology rather than coincidental failures in different states⁠2⁠6.

What remains unresolved is the central question of attribution, and it is not academic. Water operators need to know what they are defending against: opportunistic intrusion enabled by weak passwords and unpatched remote access, or a deliberate campaign by a state-linked actor testing how far it can get into American operating technology⁠5⁠6. The intelligence assessment pointing to Iran implies the latter, with implications for how utilities isolate control systems, monitor vendor access, and share indicators across state lines⁠5⁠3. The president's claim of state incompetence implies the former, but without evidence or technical detail, it gives operators nothing to patch, block or investigate⁠3⁠4⁠10. In that sense, the public dispute itself has a cost, because every day spent arguing about who to blame without sharing findings is a day utilities must defend without a clear threat picture⁠6⁠9.

The record as it stands is therefore split in a way rarely seen so openly. On one side are American intelligence agencies and federal investigators who believe Iran is behind the Minnesota attacks and assess a possible link to Iran or its proxies, while the FBI continues to investigate without a public identification⁠5⁠3⁠6⁠9. On the other side is the president, who says Iran was not responsible, who faults Minnesota and Walz, and who has provided no evidence for that alternative⁠2⁠3⁠4⁠11. A reader who never watches the broadcast should understand that both claims cannot be true at the same time, and that only one of them currently carries the institutional weight of an intelligence assessment, incomplete as it is⁠3⁠5⁠10. The other carries the weight of the presidency, but no supporting proof disclosed to the public⁠3⁠4.

Whether the federal investigation will produce a public attribution, and whether that attribution aligns with the investigators' early assessment or with the president's dismissal of it, is now the test to watch⁠6⁠9⁠10. If the FBI and intelligence agencies present technical evidence linking the intrusions to Iran or its proxies, Trump will have to explain why he rejected his own agencies at Camp David⁠3⁠11. If investigators conclude the cause was poor cyber hygiene or an unrelated actor, the president's skepticism will look more prescient, though still unsupported at the time he voiced it⁠3⁠4. And if investigators say nothing further, the public will be left with the worst outcome: more than 30 compromised water systems in one state, nine more reported in another, and a national argument about competence that never answered who got inside the controls that deliver drinking water⁠6⁠9⁠10.