Get alerts on this situation

We’ll email you as it develops, and you can follow the whole thread from day one.

Unsubscribe anytime.

[SITUATION] · [ACTIVE]

2 clusters · 54 sources · 3 days · First seen 4 days ago · Last updated 1 day ago

Minnesota water systems cyberattack

Entities: Emily Zimmer · John Israel · Minnesota IT Services (MNIT) · Cybersecurity and Infrastructure Security Agency (CISA) · Federal Bureau of Investigation (FBI)

Overview

The coordinated cyberattack that struck more than 30 Minnesota community water utilities on July 26‑27, 2026 continued to unfold. Operational technology that controls pumps, wells, valves and treatment equipment was compromised, causing brief outages at utilities in Braham, Plymouth, South St. Paul and Maple Plain. No water‑quality contamination was detected and no authorities have asked residents to reduce consumption.

Minnesota IT Services activated a statewide incident‑response operation on July 28, working with the FBI, CISA, the EPA and other partners to contain the breach and restore normal operations. The FBI confirmed direct contact with the affected utilities and later warned that similar attacks have been reported in at least six additional states, highlighting a broader vulnerability of U.S. water‑infrastructure control systems.

Investigators have not publicly identified the perpetrators, but the tactics resemble those used by Iranian‑linked hacking groups, a possibility flagged by prior FBI warnings. The investigation remains ongoing as authorities pursue containment, recovery and attribution efforts.

Claims

What the coverage asserts, and how well corroborated each claim is across sources.

[● 21 SOURCES] More than 30 community water systems in Minnesota were targeted by a coordinated cyberattack on July 26‑27, 2026. (new)
[● 20 SOURCES] No residents were asked to modify water usage and no water‑quality issues were reported. (new)
[● 20 SOURCES] The FBI, CISA, EPA and state agencies are participating in the investigation and response. (new)
[● 20 SOURCES] Cities including Braham, Plymouth, South St. Paul and Maple Plain experienced temporary outages or disruptions. (new)
[● 20 SOURCES] CISA issued a warning weeks earlier about Iranian‑affiliated actors targeting water‑infrastructure control systems. (new)
[● 19 SOURCES] The attack disrupted operational technology controlling pumps, wells and treatment equipment, causing brief outages at affected sites. (new)
[● 19 SOURCES] Minnesota IT Services activated its statewide cyber‑incident response on July 28, 2026. (new)
[● 19 SOURCES] Attribution has not been confirmed, but investigators note similarities to previous Iran‑linked hacking activity. (multiple sources)

Timeline

1 day ago

[TECHNOLOGY] 32 sources
Coordinated cyberattack hits over 30 Minnesota water systems
A coordinated cyberattack on July 26‑27, 2026 disrupted operational technology at over 30 Minnesota water systems, prompting a state‑wide response with FBI, CISA and EPA involvement; no water‑quality impact was
4 days ago

[TECHNOLOGY] 24 sources
Coordinated cyberattack hits over 30 Minnesota water systems
A coordinated cyberattack on July 26‑27 hit over 30 Minnesota water systems, prompting a state‑wide response; no water‑quality impact or public‑health advisory was reported.

Sources

adevarul.ro · antiguatribune.com · artsquest.org · bangordailynews.com · bilder3.n-tv.de · denver.cbslocal.com · diamenty.forbes.pl · epochtimes.com · ermetic.com · hotnews.ro · ibtimes.co.uk · independent.co.uk · itnerd.blog · jamaicainquirer.com · kfgo.com · krmg.com · liveblogwp.wtop.com · mediafax.ro · minnpost.com · mix929.com · monitorulcj.ro · myjoyonline.com · mymotherlode.com · nemosnewsnetwork.com · newarab.com · newindianexpress.com · news.hkheadline.com.hk · ntd.com · offgridsurvival.com · paparazzi.com.ar · pjmedia.com · pulptastic.com · republika.co.rs · russellbeattie.com · semissourian.com · singaporeanmalaysianrecipes.com · sofx.com · spacemoney.com.br · srnnews.com · stiripesurse.ro · theedadvocate.org · thehackernews.com · thelutheran.com.au · thesheffieldpress.com · trinidadtribune.com · viakoo.com · wdez.com · wdio.com

This summary has been updated 3 times: see revision history