Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline

Summary

A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems in late July, causing plant outages, communication failures, and affecting automated controls. One water plant went offline, prompting residents to minimize water use. While attribution is ongoing, the tactics are consistent with threat actors targeting critical infrastructure, potentially linked to Iranian-affiliated groups.

Full text

Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline Swati KhandelwalJul 29, 2026Critical Infrastructure / Threat Intelligence A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27, triggering a statewide cybersecurity response. Braham, Plymouth, South St. Paul and Maple Plain have publicly described a plant outage, communications failures or affected automated controls. Braham's water plant went offline, and the city asked residents to minimize water use until treatment resumed. Plymouth reported cellular communications problems at two water towers and multiple wastewater lift stations but continued operating manually. South St. Paul and Maple Plain maintained services after automated utility controls were affected, with Maple Plain declaring a local state of emergency to support its response. Minnesota IT Services (MNIT) said on July 28 that it was not aware of any active requests for residents to change their drinking-water use. Officials have not publicly identified the attacker, affected products, exploited vulnerability, or whether data was stolen. "At this point, we can confirm that more than 30 water systems throughout the state were impacted," MNIT told The Hacker News. "The nature and extent of the impact varied by system, and the investigation is still determining how many experienced operational disruptions." MNIT said the incidents shared common characteristics, including their timing, methods of access and the type of infrastructure targeted. Those similarities supported the state's description of the activity as coordinated. The agency said the similarities were consistent with activity observed by federal partners in other states and industries, but investigators could not yet determine whether a single actor was responsible for all the incidents. Investigators have also identified similarities in how the systems were accessed, MNIT said, but the agency is not sharing specific technical details while the investigation continues. Attribution has not been finalized. MNIT said it is coordinating containment, investigation, recovery and threat-intelligence sharing with state agencies, the Cybersecurity and Infrastructure Security Agency (CISA), the Environmental Protection Agency, the Federal Bureau of Investigation and affected utilities. "Cyberattacks against critical infrastructure require a coordinated, whole-of-government response," said John Israel, MNIT assistant commissioner and Minnesota chief information security officer. MNIT said the response enabled agencies to contain the incident and help prevent more serious impacts to critical services. In a separate development four days before the Minnesota attacks, U.S. agencies expanded a warning about Iranian-affiliated actors targeting internet-facing programmable logic controllers made by Rockwell Automation, Schneider Electric, Siemens and potentially other manufacturers. Investigators in that campaign observed attackers exfiltrate and modify project files, manipulate data shown through human-machine interfaces and supervisory control and data acquisition systems, and disable shutdown and alarm logic. State and federal officials have not publicly connected the Minnesota attacks to that campaign. Tenable said the timing and operational pattern were consistent with the broader CyberAv3ngers threat ecosystem, while noting that the incident has not been officially attributed. "While MNIT did not provide attribution, these tactics remain consistent with the tradecraft attributed to CyberAv3ngers and other IRGC-CEC affiliated groups, who have been known to target critical infrastructure since at least 2023," Scott Caveza, senior staff research engineer at Tenable, told The Hacker News. Caveza said U.S. agencies have previously warned that CyberAv3ngers and other groups affiliated with Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command have targeted water and wastewater systems through programmable logic controllers and human-machine interfaces, in some cases causing operational interruptions. CISA's advisory provides sector-wide defensive guidance. Minnesota officials have not publicly identified a programmable logic controller family, specific access method, or vulnerability used in the attacks. CISA also recommends logging cellular modem connections, restricting controller access to authorized systems and inspecting running project files for unauthorized changes. Operators should validate backups before restoration and, where a controller has a physical mode switch, place it in run mode only after validating its project files. As of July 29, 2026, MNIT said the investigation remained active and responders were continuing to assess affected systems. Update: This article was updated after publication to include comments from MNIT and Tenable. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  critical infrastructure, cyberattack, Government security, industrial control system, network security, Operational Technology, SCADA Security, Threat Intelligence ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources Identity Fraud Is Changing Fast. See the Attacks Businesses Face in 2026 What 25 Million Alerts Reveal About the Threats SOCs Ignore How to Find and Control Every Script Running Through Your Marketing Stack Modern SASE Guide: Close the Gaps Traditional Network Security Cannot See

Entities