A coordinated cyberattack hit operational technology systems at more than 30 community water utilities across Minnesota on July 26 and 27, forcing some facilities to take treatment plants offline and prompting a joint state-federal investigation.
According to Minnesota IT Services, the attackers targeted automated control functions at water and wastewater systems across the state. The city of Braham took its water plant offline after discovering the intrusion, urging residents to minimize water use. Officials said the attackers shut down well and treatment plant operating controls.
Plymouth officials noted the impact was limited to equipment connected via cellular communications, pointing to cellular modems at remote water towers and lift stations as the likely vector. Security experts noted that secondary communication links are often overlooked in risk assessments, matching a pattern seen in 2020 Iranian-linked attacks against Israeli water facilities.
Investigators have not formally attributed the attack, though Iranian threat groups including CyberAv3ngers and Handala fit the profile. The intrusions come days after the US government warned about Iran-linked hackers targeting Siemens, Rockwell Automation, and Schneider Electric industrial control systems.
All affected cities confirmed drinking water remains safe and services are operational under contingency procedures. Researchers warned the same vulnerabilities likely exist in water infrastructure beyond Minnesota, urging broader OT security assessments across the sector.
