Cyber Attack Affects Water Systems in Minnesota

By July 30, 2026, a malicious cyber activity impacted technology at over 30 community water systems in Minnesota. This incident forced some utilities to switch to manual operations. State and federal authorities are investigating the source of the attack. There is suspicion of Iranian involvement, although attribution is not yet confirmed.

According to Minnesota IT Services, the attack targeted technology used to remotely monitor and control equipment, including programmable logic controllers (PLCs). Despite the breach, no Minnesota water supply has reportedly been compromised. Mike Ernster from the Minnesota Department of Public Safety stated that the Bureau of Criminal Apprehension’s Minnesota Fusion Center is collaborating with municipalities and other agencies to address the situation.

Nick Anderson, acting director of the Cybersecurity and Infrastructure Security Administration (CISA), noted an increase in cyber threats targeting PLCs at water utilities. He urged infrastructure owners to disconnect publicly exposed PLCs from the internet as a preventative measure.

Investigations revealed similarities in timing and technology among the incidents, yet have not definitively linked them to a single actor. In South St. Paul, measures were swiftly taken to switch to manual operations, avoiding service interruptions. The city’s spokesperson indicated that operational impacts were limited, with no compromise to drinking water quality or delivery.

In the city of Braham, officials noticed a malfunction on Monday. Public works personnel managed to restore service within 90 minutes, avoiding any disruption to water supply. Mayor Nate George confirmed the situation was under control before an automatic alert was received. Since the incident, the system has been disconnected from public internet networks, and discussions with technology providers are underway for further improvements.

The FBI is aware of the occurrence and remains in contact with affected parties. CISA reiterated the ongoing risks, advising critical infrastructure managers to verify all external connections, especially those involving undetected cellular modems.

Hackers linked to Iran’s Islamic Revolutionary Guard Corps have previously targeted U.S. water utilities, exploiting unsecured internet-connected controllers in a similar manner in 2023.