Cyberattack Disrupts Over 30 Minnesota Water Systems

A coordinated cyberattack struck operational technology at over 30 community water systems across Minnesota on July 26 and 27, leading to a statewide cybersecurity response. Cities including Braham, Plymouth, South St. Paul, and Maple Plain reported various issues such as plant outages and communication failures. Braham's water plant was forced offline, prompting officials to request residents minimize water usage until treatment could resume. Plymouth experienced cellular communication problems affecting two water towers and multiple wastewater lift stations but managed to continue operations manually. South St. Paul and Maple Plain maintained service despite disruptions to automated controls, with Maple Plain declaring a local state of emergency to aid its response. Minnesota IT Services (MNIT) stated on July 28 that there were no active requests for residents to alter their drinking water use. The identity of the attacker, the specific vulnerabilities exploited, and whether any data was stolen remain undisclosed. MNIT confirmed that more than 30 water systems were impacted, with the nature and extent of disruptions varying by system. The agency noted that the incidents exhibited common characteristics, including timing and methods of access, which led to the classification of the activity as coordinated. While similarities were observed with incidents reported by federal partners in other states and sectors, investigators have not determined if a single actor was responsible for all incidents. MNIT has identified common access methods but is withholding specific technical details as the investigation progresses. The agency is collaborating with state agencies, the Cybersecurity and Infrastructure Security Agency (CISA), the Environmental Protection Agency, the Federal Bureau of Investigation, and affected utilities to manage containment, investigation, recovery, and threat intelligence sharing. John Israel, MNIT assistant commissioner and Minnesota chief information security officer, emphasized the need for a coordinated governmental response to cyberattacks on critical infrastructure. The response efforts have helped contain the incident and mitigate potential serious impacts on essential services. In a related development, just four days prior to the Minnesota attacks, U.S. agencies issued a warning regarding Iranian-affiliated actors targeting internet-facing programmable logic controllers from manufacturers like Rockwell Automation, Schneider Electric, and Siemens. Investigators noted that attackers in this campaign had exfiltrated and modified project files, manipulated data displayed through human-machine interfaces, and disabled shutdown and alarm logic. Although state and federal officials have not linked the Minnesota attacks to this campaign, Tenable highlighted that the timing and operational patterns align with the broader CyberAv3ngers threat ecosystem. Scott Caveza, a senior staff research engineer at Tenable, noted that U.S. agencies had previously warned of CyberAv3ngers and other groups associated with Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command targeting water and wastewater systems, sometimes causing operational interruptions. CISA's advisory offers sector-wide defensive guidance, but Minnesota officials have not specified the family of programmable logic controllers involved, the access methods used, or the vulnerabilities exploited in the attacks. CISA recommends logging cellular modem connections, restricting controller access to authorized systems, and inspecting project files for unauthorized changes. Operators are advised to validate backups before restoration and to ensure that controllers are in run mode only after confirming project file integrity. As of July 29, 2026, MNIT reported that the investigation remains active, with responders continuing to evaluate the affected systems. This article was updated after publication to include comments from MNIT and Tenable.