Minnesota Water Systems Hit by Coordinated Cyberattack

Minnesota water systems coordinated cyberattack industrial control systems MNIT

A coordinated cyberattack targeted the operational technology of more than 30 community water and wastewater systems in Minnesota on July 26‑27, 2024. The intrusion affected control valves, pumps and other industrial control systems (SCADA/PLC), causing temporary outages at facilities in Braham, Plymouth, South St. Paul, Maple Plain, St. Cloud and several other towns. All affected utilities switched to manual operation, restoring service within a few hours and confirming that water quality and public safety were unchanged. No public‑health advisory or water‑use restrictions were issued.

Minnesota IT Services (MNIT) activated a statewide response, coordinating with federal partners—including the FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and the Environmental Protection Agency (EPA)—to investigate, share threat intelligence and support recovery. MNIT Assistant Commissioner and chief information security officer John Israel said the whole‑of‑government effort “worked as intended,” preventing more serious impacts. The agency’s spokesperson Emily Zimmer noted that investigators identified unauthorized, malicious access but could not yet attribute the attacks; the threat actor remains unidentified, though the tactics resemble previous Iran‑linked intrusions into U.S. water infrastructure. The attacks did not involve ransom demands.

Entities: Braham, Minnesota · Emily Zimmer · John Israel · Minnesota IT Services (MNIT) · Minnesota Information Technology Services (MNIT) · Plymouth, Minnesota · South St. Paul, Minnesota

Claims

What the coverage asserts, and how well corroborated each claim is across sources.

[● 4 SOURCES] Utilities switched to manual operation, restoring service within a few hours with no impact on water quality. (source)
[● 2 SOURCES] MNIT activated a statewide response and coordinated with federal agencies including CISA, EPA and FBI. (MNIT statement)
[● 5 SOURCES] No public health advisories were issued and there was no request for residents to change drinking‑water usage. (source)
[● 8 SOURCES] More than 30 Minnesota communities experienced water utility disruptions due to a coordinated cyberattack. (source)
[● 6 SOURCES] The attacks targeted industrial control systems (SCADA) used to monitor and operate water infrastructure. (source)
[● 5 SOURCES] The cyberattack occurred on July 26 and July 27, 2024. (source)
[● 2 SOURCES] The attack vector may have involved cellular communications linking remote assets. (source)
[● 6 SOURCES] The threat actor behind the cyberattack remains unidentified. (source)