President Donald Trump said on Friday that he does not believe Iran was behind a series of cyberattacks on water systems in Minnesota and at least six other states, contradicting assessments by federal and state investigators. Speaking during a cabinet meeting at Camp David, Trump said: “I blame it on Minnesota because they’re grossly incompetent.” He added that Iran had “bigger problems” than Minnesota. The president did not offer an alternative origin for the attacks.

Minnesota Governor Tim Walz, a Democrat whom Trump singled out for criticism, responded on X that Trump “knows exactly who is responsible for this attack, and knows that other states were hit, too.” Walz also blamed cuts to the Cybersecurity and Infrastructure Security Agency (CISA) — imposed by Elon Musk’s DOGE team — for leaving the country exposed. The FBI, in a statement on Thursday, confirmed that water and wastewater utilities in at least seven states had reported incidents that in some cases “disrupted water supply operations.” A U.S. official with knowledge of the matter told MSNBC that Iranian hackers were the likely perpetrators.

Federal investigators have not formally attributed the attacks to any actor. However, a July 22 joint advisory from the FBI, NSA, EPA and CISA associated the hacking campaign with Iran, according to reports. The New York Times and Washington Post, citing unnamed officials, said preliminary inquiries pointed to Tehran. The attacks, which began on July 26–27 in Minnesota, targeted programmable logic controllers and other remote-monitoring equipment used to manage water treatment. An alert issued in April by CISA, FBI, NSA and other agencies had previously warned that Iranian-linked hackers were targeting such technology. The White House referred questions to the FBI, which declined to comment on Iranian involvement.

No state or federal agency has officially blamed Iran. CISA said it was coordinating with the EPA and private-sector partners to assess the scope of the incidents. The investigation into the Minnesota attacks remains ongoing, according to the state’s information technology agency. Experts quoted by Reuters and other outlets noted that the attacks bore similarities to earlier Iranian-linked activity against critical infrastructure, but no definitive attribution has been made public.