started · updated
Coordinated Cyberattack Hits Over 30 Minnesota Water Systems
More than 30 community water systems in Minnesota were hit by a coordinated cyberattack on July 26‑27, 2026. The intrusion targeted internet‑exposed programmable logic controllers and other operational technology, forcing several utilities to switch to manual operation for a few hours. No drinking‑water contamination was reported and residents were not asked to reduce usage.
Federal agencies – the FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and the Environmental Protection Agency (EPA) – are assisting state officials in the investigation. Investigators say the tactics and tools resemble those used by Iranian‑affiliated groups such as CyberAv3ngers, but attribution remains unconfirmed. Similar incidents have been reported in at least six other U.S. states, bringing the total to seven states.
Political commentary accompanied the technical response; President Donald Trump publicly blamed Minnesota’s leadership rather than Iran for the attack. State and local officials continue to restore affected systems and to harden defenses against future cyber threats.
Entities
CyberAv3ngers · Cybersecurity and Infrastructure Security Agency · Cybersecurity and Infrastructure Security Agency (CISA) · Emily Zimmer · Environmental Protection Agency · Environmental Protection Agency (EPA) · Federal Bureau of Investigation · Federal Bureau of Investigation (FBI) · Iranian‑linked hacking group CyberAv3ngers · Iran‑linked hacking groups (e.g., CyberAv3ngers) · John Israel · Minnesota
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 21 SOURCES] The attack disrupted operational technology controlling pumps, wells and treatment equipment, targeting programmable logic controllers (PLCs). antiguatribune.com · dominicanrepublicpost.com · jamaicainquirer.com · nemosnewsnetwork.com · trinidadtribune.com · +14 more
- [● 21 SOURCES] Minnesota IT Services activated its statewide incident‑response team on July 28. antiguatribune.com · dominicanrepublicpost.com · jamaicainquirer.com · nemosnewsnetwork.com · trinidadtribune.com · +14 more
- [● 23 SOURCES] No residents were asked to modify water usage and no water‑quality issues were reported. antiguatribune.com · dominicanrepublicpost.com · jamaicainquirer.com · nemosnewsnetwork.com · trinidadtribune.com · +16 more
- [● 27 SOURCES] More than 30 community water systems in Minnesota were targeted by a coordinated cyberattack on July 26‑27, 2026. antiguatribune.com · dominicanrepublicpost.com · jamaicainquirer.com · nemosnewsnetwork.com · trinidadtribune.com · +19 more
- [● 7 SOURCES] Investigators consider the attack may be linked to Iranian‑affiliated hackers, possibly the CyberAv3ngers group, but attribution remains unconfirmed. www.sofx.com · www.newarab.com · www.n-tv.de · www.lootpress.com · nemosnewsnetwork.com · +2 more
- [● 6 SOURCES] Cynthia Kaiser warned the attack pattern resembles activity from Iranian‑linked hackers. www.standard-democrat.com · wtop.com · www.independent.co.uk · nemosnewsnetwork.com · offgridsurvival.com · +1 more
- [● 23 SOURCES] Federal agencies FBI, CISA, and EPA are involved in the investigation and response. antiguatribune.com · dominicanrepublicpost.com · jamaicainquirer.com · nemosnewsnetwork.com · trinidadtribune.com · +16 more
- [● 18 SOURCES] Officials have not publicly identified the attacker; attribution remains unconfirmed. antiguatribune.com · dominicanrepublicpost.com · jamaicainquirer.com · nemosnewsnetwork.com · trinidadtribune.com · +11 more
- [● 19 SOURCES] Minnesota IT Services activated its statewide incident‑response team and is coordinating with the FBI, CISA and EPA. antiguatribune.com · dominicanrepublicpost.com · jamaicainquirer.com · nemosnewsnetwork.com · trinidadtribune.com · +11 more
- [● 22 SOURCES] The FBI confirmed it is in direct contact with affected utilities to resolve the matter. antiguatribune.com · dominicanrepublicpost.com · jamaicainquirer.com · nemosnewsnetwork.com · trinidadtribune.com · +14 more
- [● 19 SOURCES] No municipal authorities have asked residents to reduce water usage and no water‑quality impact has been reported. antiguatribune.com · dominicanrepublicpost.com · jamaicainquirer.com · nemosnewsnetwork.com · trinidadtribune.com · +11 more
- [● 20 SOURCES] CISA issued a warning weeks earlier about Iranian‑affiliated actors targeting water‑infrastructure control systems. antiguatribune.com · dominicanrepublicpost.com · jamaicainquirer.com · nemosnewsnetwork.com · trinidadtribune.com · +12 more