Cyberattack Disrupts Water Utilities in Minnesota
A coordinated cyberattack disrupted water and wastewater utility operations across more than 30 communities in Minnesota between July 26 and July 27, 2026. The cities of Braham, Plymouth, South St. Paul, and Maple Plain publicly reported the incidents, with Minnesota IT Services characterizing the event as a targeted attack on community water systems statewide. In Braham, the attack disabled computerized controls, temporarily shutting down the city's well and water treatment plant, which was restored within two hours. Plymouth's IT division disconnected cellular-connected equipment at two water towers and wastewater lift stations to halt the attack, while South St. Paul experienced issues with automated controls. Maple Plain declared a local state of emergency to enhance its response capabilities. Fortunately, officials confirmed that drinking water quality was not compromised, and no boil-water advisories were issued. The Minnesota Department of Health is collaborating with the affected water systems to ensure public health safety.
While federal and state officials have not attributed the attacks to a specific actor, the operational patterns align with the CyberAv3ngers threat group, which the U.S. government has linked to Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command. This group has been active since at least 2020 and has been involved in various cyber operations targeting critical infrastructure. In February 2024, the U.S. Treasury Department sanctioned six IRGC-CEC officials for their roles in directing CyberAv3ngers operations, and the State Department has offered rewards for information on the group.
The timing of the Minnesota attacks is notable, occurring just days after the Cybersecurity and Infrastructure Security Agency (CISA) updated its advisory on July 22, 2026, warning that Iranian-affiliated actors were compromising internet-connected programmable logic controllers (PLCs) across U.S. water, energy, and government sectors. This advisory documented disruptions and financial losses at multiple organizations, indicating a growing threat to critical infrastructure.
CISA's July update expanded its scope to include targeting of Schneider Electric and Siemens PLCs, in addition to Rockwell Automation devices. It detailed new tactics employed by attackers, including the use of vendor engineering software to exfiltrate PLC project files from victim environments. The advisory also provided detection guidance for manipulation of Add-On Instructions (AOIs) within PLC programs, highlighting the potential for actors to disable safety systems and manipulate operational data.
CyberAv3ngers has shown a pattern of capability escalation over time, evolving from a propaganda persona to exploiting vulnerabilities in critical infrastructure. The group has compromised numerous small water utilities, often using consumer-grade remote access tools or exposing PLC management interfaces to the public internet, which bypasses traditional security measures. This trend underscores the vulnerabilities faced by smaller utilities, which often lack the resources for robust cybersecurity measures.
The geopolitical context surrounding these attacks is significant, as tensions between the U.S. and Iran have escalated since early 2026. Iranian cyber operations have intensified alongside military conflicts, with confirmed targeting of U.S. critical infrastructure. The proliferation of CyberAv3ngers' techniques to affiliated hacktivist groups further complicates the threat landscape, increasing the risk of unintended consequences from cyber operations.
Organizations operating internet-exposed PLCs, particularly those from Rockwell Automation, Schneider Electric, and Siemens, are urged to implement robust security measures, including network segmentation and monitoring for suspicious activity. The ongoing threat to critical infrastructure necessitates vigilance and proactive defense strategies to mitigate risks associated with cyberattacks.
