"I think that Minnesota is behind it," President Donald Trump told reporters Friday, adding that the state was "grossly incompetent" and that he did not believe there was an Iranian cyberattack.
What the president said, and what officials would not clarify
President Donald Trump publicly questioned the attribution of recent cyber intrusions against U.S. water systems, telling reporters he thought Minnesota was "behind it" because the state was "grossly incompetent." The White House referred a request for clarification back to the president's remarks, and did not clarify whom Trump believed was responsible for similar attacks in other states, according to the reporting.
Attribution from federal agencies and industry partners
U.S. investigators have attributed the recent activity to Iran, and the Cybersecurity and Infrastructure Security Agency (CISA) issued an updated advisory that federal and industry sources say is aligned with observed activity. CISA’s joint advisory — cited by WaterISAC — appears under the identifier AA26-097A and is titled "Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across U.S. Critical Infrastructure." WaterISAC's executive director Tom Dobbins told CyberScoop that the organization is "confident in our government partners' assessment" and said it had "evidence of earlier attacks from Iran even before this current conflict."
Cybersecurity community response and expert pushback
A range of cybersecurity professionals publicly rejected the president's characterization. Chris Wysopal, Veracode co-founder and chief security evangelist, said on the Bluesky social media platform that "Victim blaming in cyber is so 2000 and late." Jake Williams, a member of the IANS faculty, pointed out that "his own intelligence services are attributing this to Iran." Bryson Bort, CEO and founder of Scythe and co-founder of the ICS Village, described the incident as "a target of opportunity" and said "it wasn't that Minnesota did something as a state to raise Iran's ire."
Andy Jabbour, founder and CEO of Gate 15, urged caution about political allegations, saying on CyberScoop he was "not even sure what [the president] was actually saying" and that "random unsubstantiated allegations aimed at political opponents seem reckless and are a disservice to the American people." Cynthia Kaiser, now senior vice president at Halcyon and a former top FBI cyber official, explained the bureau's typical approach to attribution — technical indicators, capability, past behavior and motive — and said "Iran ticks all these kinds of things," adding she would "be shocked if we found out it wasn't Iran."
Minnesota's response and Gov. Tim Walz's rebuttal
Gov. Tim Walz, whose administration is coordinating the state's response, pushed back in a Facebook post. Walz said the administration "knows exactly who is responsible for this attack," noted cuts to federal funding and said "DOGE took an axe to CISA and left the U.S. exposed to cyber attacks." He credited Minnesota experts with quickly identifying the vulnerability and working with local communities to stop it. A spokesperson for Minnesota IT Services, Emily Zimmer, declined to address the president’s remarks and said the agency "remain[s] focused on supporting affected communities, securing critical infrastructure and coordinating with local partners and federal officials as the investigation continues" and would "not comment on political statements or speculate about attribution."
How technologists, policymakers, and affected communities are responding
- Technologists and security teams: Experts cited CISA and FBI statements and the AA26-097A advisory when assessing the activity; some described the incidents as opportunistic exploitation of internet-exposed programmable logic controllers common in water-sector control systems.
- Policymakers and regulators: Officials and industry groups have pointed to recent cuts in federal cybersecurity capacity and called for more funding — Tom Dobbins urged Congress to provide funding for WaterISAC so the ISAC can continue coordinating threat information.
- Affected communities and local governments: Minnesota IT Services and state experts are actively working with local communities to secure systems; the state's spokesperson emphasized coordination with federal officials as the investigation continues.
The record in the reporting is crisp on two points: the president publicly blamed Minnesota and explicitly rejected an Iranian attribution, and federal agencies and multiple cybersecurity professionals and industry groups have tied the incidents to Iranian-affiliated actors and to activity described in CISA’s advisory AA26-097A. The White House did not clarify the president's statement, and Minnesota state officials declined to engage on attribution while focusing on response and remediation.
Link to original story: https://cyberscoop.com/trump-blames-minnesota-water-cyberattacks-iran/
