Coordinated cyberattack hits over 30 Minnesota water systems
More than 30 community water systems in Minnesota were hit by a coordinated cyberattack on July 26‑27, 2026. The attack compromised operational technology that controls pumps, wells, valves and treatment equipment, causing brief outages at several utilities. Cities such as Braham, Plymouth, South St. Paul and Maple Plain experienced temporary disruptions, but no water‑quality issues or mandatory usage reductions were reported.
Minnesota IT Services activated a statewide incident‑response operation on July 28 and is working with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the Environmental Protection Agency and other federal and state partners. The FBI confirmed it is in direct contact with the affected utilities. While investigators have not publicly identified the perpetrators, officials noted that the attack patterns resemble those used by Iranian‑linked hacking groups, a possibility highlighted by former FBI cyber‑division official Cynthia Kaiser. CISA had earlier warned of Iranian‑affiliated actors targeting water‑infrastructure control systems.
The FBI later warned that similar attacks had been reported in at least six additional states, underscoring broader vulnerability of U.S. water infrastructure.
Entities: Cybersecurity and Infrastructure Security Agency · Cybersecurity and Infrastructure Security Agency (CISA) · Emily Zimmer · Federal Bureau of Investigation · Federal Bureau of Investigation (FBI) · Iran‑linked hacking groups (e.g., CyberAv3ngers) · John Israel · Minnesota · Minnesota IT Services · Minnesota IT Services (MNIT) · Minnesota water systems
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [● 20 SOURCES] No residents were asked to modify water usage and no water‑quality issues were reported. (new)
- [● 21 SOURCES] More than 30 community water systems in Minnesota were targeted by a coordinated cyberattack on July 26‑27, 2026. (new)
- [● 6 SOURCES] Cynthia Kaiser warned the attack pattern resembles activity from Iranian‑linked hackers. (new)
- [● 20 SOURCES] The FBI, CISA, EPA and state agencies are participating in the investigation and response. (new)
- [● 2 SOURCES] Tenable assessed the attack as consistent with the CyberAv3ngers group tied to Iran’s IRGC, though this is not officially confirmed. (new)
- [● 18 SOURCES] Officials have not publicly identified the attacker; attribution remains unconfirmed. (new)
- [● 19 SOURCES] The attack disrupted operational technology controlling pumps, wells and treatment equipment, causing brief outages at affected sites. (new)
- [● 19 SOURCES] Minnesota IT Services activated its statewide cyber‑incident response on July 28, 2026. (new)
- [● 19 SOURCES] Minnesota IT Services activated its statewide incident‑response team and is coordinating with the FBI, CISA and EPA. (multiple sources)
- [● 19 SOURCES] The FBI confirmed it is in direct contact with affected utilities to resolve the matter. (multiple sources)
- [● 19 SOURCES] No municipal authorities have asked residents to reduce water usage and no water‑quality impact has been reported. (multiple sources)
- [● 20 SOURCES] CISA issued a warning weeks earlier about Iranian‑affiliated actors targeting water‑infrastructure control systems. (new)