Coordinated cyberattack hits over 30 Minnesota water systems

Minnesota water systems coordinated cyberattack SCADA MNIT

On July 26 and July 27, a coordinated cyberattack targeted more than 30 community water systems across Minnesota. The state’s IT agency, Minnesota IT Services (MNIT), activated a statewide response, working with federal partners including the FBI, CISA and EPA to contain the incident and assist affected utilities.

The attack disrupted automated control systems (SCADA/PLC) at the facilities, forcing some to switch to manual operation. One plant in Braham was briefly offline before service was restored within a few hours. MNIT reported that no public‑health advisories were issued and there were no requests for residents to change their drinking‑water usage. Water quality and public safety were not compromised.

Investigators have not attributed the attacks to a specific actor, but the tactics match previous intrusions linked to Iranian‑affiliated hackers targeting U.S. water infrastructure. The investigation remains ongoing.

Entities

Braham, Minnesota · Cybersecurity and Infrastructure Security Agency (CISA) · Emily Zimmer · Federal Bureau of Investigation (FBI) · John Israel · Minnesota · Minnesota IT Services (MNIT) · Minnesota Information Technology Services (MNIT) · Plymouth, Minnesota · South St. Paul, Minnesota · Water utilities

Claims

What the coverage asserts, and how many sources carry each claim.

[● 5 SOURCES] Utilities switched to manual operation, restoring service within a few hours with no impact on water quality. itnerd.blog · statescoop.com · www.minnpost.com · www.wdio.com · thesheffieldpress.com
[● 5 SOURCES] No public health advisories were issued and there was no request for residents to change drinking‑water usage. www.kaaltv.com · mix929.com · thesheffieldpress.com · wdez.com · www.wdio.com
[● 2 SOURCES] MNIT activated a statewide response and coordinated with federal agencies. www.kaaltv.com · statescoop.com
[● 5 SOURCES] The cyberattack occurred on July 26 and July 27. www.kaaltv.com · mix929.com · thesheffieldpress.com · wdez.com · www.wdio.com
[● 8 SOURCES] More than 30 Minnesota communities experienced water utility disruptions due to a coordinated cyberattack. www.kaaltv.com · itnerd.blog · statescoop.com · mix929.com · thesheffieldpress.com · +3 more
[● 6 SOURCES] The attacks targeted industrial control systems (SCADA) used to monitor and operate water infrastructure. itnerd.blog · statescoop.com · www.kaaltv.com · mix929.com · kelo.com · +1 more
[● 2 SOURCES] The attack vector may have involved cellular communications linking remote assets. itnerd.blog · www.minnpost.com
[● 6 SOURCES] The threat actor behind the cyberattack remains unidentified. statescoop.com · mix929.com · thesheffieldpress.com · wdez.com · www.wdio.com · +1 more