More than 30 Minnesota water systems targeted in coordinated cyberattack

More than 30 Minnesota community water systems were targeted in attacks over Sunday, July 26, and Monday, July 27, 2026, according to Minnesota IT Services, which activated a statewide cybersecurity response.

The incidents involved technology used to operate, monitor or communicate with water infrastructure, including operational technology and automated controls. Public reports described disruptions to those systems, not a confirmed contamination event or a statewide loss of water service.

Braham briefly lost operating controls

In Braham, the attack shut down operating controls for the city’s well and water-treatment plant. The city temporarily relied on water stored in its tower while crews worked to restore operations.

Braham asked residents to minimize water use for a few hours on Monday, July 27. City officials said the incident did not affect water quality or safety.

The Braham incident shows why an attack on water-system technology does not automatically mean tap water is unsafe. In this case, the reported problem affected the plant’s normal operating controls; officials did not report contamination or a public-health threat.

Other communities continued service manually

Plymouth officials said communications affecting two water towers and multiple lift stations were restored by Tuesday afternoon. Crews continued operating the system manually during the disruption, and the city said water levels and quality were unaffected.

Maple Plain reported an incident involving certain automated control functions but said normal water operations continued. South St. Paul reported impacts to some automated controls while Public Works employees maintained normal water and wastewater operations.

The incidents did not affect every community in the same way. Minnesota IT Services said the events had similarities in timing and the types of technology involved, but investigators had not determined whether the same attacker was responsible for all of them.

What residents should know about water safety

FOX 9 reported that the Minnesota Department of Health was not aware of any municipality asking residents to alter their drinking-water use because of the attacks. The named communities said water quality and safety were not affected, although Braham separately asked residents to limit use temporarily while its system was being assessed.

Residents should follow notices from their own city or water utility if a conservation request, boil-water advisory or other instruction is issued. An attack affecting automated controls or communications does not by itself establish that tap water is contaminated or unsafe.

Investigators have not identified an attacker

Minnesota IT Services, the FBI, the Cybersecurity and Infrastructure Security Agency and other partners are investigating. No attacker has been publicly identified, and Minnesota officials have not attributed the Minnesota incidents to Iran or any other actor.

Federal officials have separately warned that Iranian hackers have targeted water and wastewater systems. That warning provides threat context, but it does not establish who was responsible for the Minnesota incidents.

The full list of affected water systems and the investigation’s final findings were not public as of Wednesday, August 5. Recovery and forensic work were continuing, along with efforts to support affected communities and strengthen protections for systems used to manage wells, treatment plants, towers, lift stations and related communications.

Minnesota’s reporting framework requires prompt notice

Minnesota IT Services says covered government entities, public agencies and contractors must submit an initial cybersecurity incident report within 72 hours after discovering, or reasonably identifying or believing, that an incident occurred. The deadline is 24 hours when criminal-justice information or systems are affected.

The state says an initial report can be updated as an investigation continues. MNIT also says information from reports may be anonymized and combined before threat information is shared with local entities.

For residents, the practical message remains local: watch for notices from your water provider, follow any official conservation or safety instructions, and do not assume that a cyberattack on operating technology means the water supply is unsafe.

Sources

Discover more from Interactive News

Subscribe to get the latest posts sent to your email.