A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27, triggering a statewide cybersecurity response.
Braham, Plymouth, South St. Paul and Maple Plain have publicly described a plant outage, communications failures or affected automated controls.
Braham’s water plant went offline, and the city asked residents to minimize water use until treatment resumed. Plymouth reported cellular communications problems at two water towers and multiple wastewater lift stations but continued operating manually.
South St. Paul and Maple Plain maintained services after automated utility controls were affected, with Maple Plain declaring a local state of emergency to support its response.
Minnesota IT Services (MNIT) said on July 28 that it was not aware of any active requests for residents to change their drinking-water use. Officials have not publicly identified the attacker, affected products, exploited vulnerability, or whether data was stolen.
“At this point, we can confirm that more than 30 water systems throughout the state were impacted,” MNIT told The Hacker News. “The nature and extent of the impact varied by system, and the investigation is still determining how many experienced operational disruptions.”
MNIT said the incidents shared common characteristics, including their timing, methods of access and the type of infrastructure targeted. Those similarities supported the state’s description of the activity as coordinated.
The agency said the similarities were consistent with activity observed by federal partners in other states and industries, but investigators could not yet determine whether a single actor was responsible for all the incidents.
Investigators have also identified similarities in how the systems were accessed, MNIT said, but the agency is not sharing specific technical details while the investigation continues. Attribution has not been finalized.
MNIT said it is coordinating containment, investigation, recovery and threat-intelligence sharing with state agencies, the Cybersecurity and Infrastructure Security Agency (CISA), the Environmental Protection Agency, the Federal Bureau of Investigation and affected utilities.
“Cyberattacks against critical infrastructure require a coordinated, whole-of-government response,” said John Israel, MNIT assistant commissioner and Minnesota chief information security officer.
MNIT said the response enabled agencies to contain the incident and help prevent more serious impacts to critical services.
In a separate development four days before the Minnesota attacks, U.S. agencies expanded a warning about Iranian-affiliated actors targeting internet-facing programmable logic controllers made by Rockwell Automation, Schneider Electric, Siemens and potentially other manufacturers.
Investigators in that campaign observed attackers exfiltrate and modify project files, manipulate data shown through human-machine interfaces and supervisory control and data acquisition systems, and disable shutdown and alarm logic.
State and federal officials have not publicly connected the Minnesota attacks to that campaign. Tenable said the timing and operational pattern were consistent with the broader CyberAv3ngers threat ecosystem, while noting that the incident has not been officially attributed.
“While MNIT did not provide attribution, these tactics remain consistent with the tradecraft attributed to CyberAv3ngers and other IRGC-CEC affiliated groups, who have been known to target critical infrastructure since at least 2023,” Scott Caveza, senior staff research engineer at Tenable, told The Hacker News.
Caveza said U.S. agencies have previously warned that CyberAv3ngers and other groups affiliated with Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command have targeted water and wastewater systems through programmable logic controllers and human-machine interfaces, in some cases causing operational interruptions.
CISA’s advisory provides sector-wide defensive guidance. Minnesota officials have not publicly identified a programmable logic controller family, specific access method, or vulnerability used in the attacks.
CISA also recommends logging cellular modem connections, restricting controller access to authorized systems and inspecting running project files for unauthorized changes. Operators should validate backups before restoration and, where a controller has a physical mode switch, place it in run mode only after validating its project files.
As of July 29, 2026, MNIT said the investigation remained active and responders were continuing to assess affected systems.
Update: This article was updated after publication to include comments from MNIT and Tenable.
