Cyberattack Hits Over 30 Minnesota Water Utilities

Minnesota IT Services (MNIT) has initiated its cybersecurity incident response protocols following a coordinated cyberattack that targeted over 30 community water systems across the state. The attacks took place on July 26 and 27, specifically affecting the operational technology (OT) systems of local water utilities.

The City of Braham reported that its water plant was offline for an unspecified reason, prompting crews to troubleshoot the issue. Shortly thereafter, the city announced that the water plant was back online and functioning normally, allowing residents to resume regular water use. City officials later confirmed that the outage was due to a malicious cyber-attack on the computerized operating systems.

In addition to Braham, other communities reported temporary equipment malfunctions, leading them to switch to manual operations or activate contingency plans to ensure continued service. MNIT is currently collaborating with federal, state, local, Tribal, and private-sector partners to investigate the attacks and strengthen the security of Minnesota's critical infrastructure.

As MNIT's cybersecurity teams assess the situation, they are sharing threat intelligence and providing guidance on response efforts and best practices to help affected utilities manage and remediate the damages caused by the attack. The agency has indicated that it has not received any requests from Minnesota cities for residents to alter their drinking water usage.

In a recent advisory, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommended that critical infrastructure organizations isolate key OT systems to maintain continuity of essential services during cyberattacks. This guidance, titled "CI Fortify – Advice for isolating vital systems," was developed in collaboration with the Australian Signals Directorate's Australian Cyber Security Centre, the FBI, and international partners.

While the identity of the attackers remains unknown, government agencies have noted that critical infrastructure is frequently targeted by state-sponsored hackers for espionage or potential disruptive activities during crises. Earlier this year, the U.S. government issued warnings regarding Iranian hackers targeting programmable logic controllers (PLCs) in critical infrastructure sectors, which had resulted in operational disruptions and financial losses across various industries, including water and wastewater systems and energy facilities.