TECHNOLOGY

Coordinated Cyberattack Strikes Over 30 Minnesota Water Utilities

▪

Read, Watch or Listen

Media Bias Meter

Sources: 20

Center 100%

Sources: 20

A coordinated cyberattack struck operational technology systems at more than 30 community water utilities across Minnesota on July 26 and July 27, 2026. Minnesota IT Services confirmed the security breach in an official statement and activated emergency cybersecurity incident response protocols to contain the threat and secure critical infrastructure. The Minnesota Department of Health coordinated directly with the impacted municipal water systems to monitor public safety and protect public health. State officials confirmed that no city requested residents to alter drinking water consumption, and initial assessments indicated no loss of water or wastewater service continuity. Four affected municipalities publicly disclosed details regarding the incident, including Braham, Plymouth, South St. Paul, and Maple Plain. Federal cybersecurity agencies responded alongside state entities. On July 28, the Cybersecurity and Infrastructure Security Agency, alongside international partners from Australia, the United Kingdom, and Canada, published emergency guidance titled CI Fortify to advise critical infrastructure operators on isolating essential operational technology networks from broader enterprise connections. Security researchers from Tenable indicated that the timing and tactics mirror prior campaigns attributed to the Iran-linked threat group CyberAv3ngers, which has historically targeted small municipal water utilities and energy infrastructure by exploiting exposed programmable logic controllers and insecure remote-access tools such as TeamViewer and AnyDesk. Minnesota IT Services Assistant Commissioner and State CISO John Israel emphasized that safeguarding critical infrastructure necessitates a comprehensive, multi-agency response model. Investigations remain ongoing as state and federal teams analyze compromised control systems, examine log files, and assist local utilities in reinforcing digital defenses against further malicious activity.

Prepared by Jonathan Pierce and reviewed by editorial team.

Timeline of Events

On April 7, 2026, federal agencies issued critical infrastructure security warnings to operators nationwide.
On July 22, 2026, federal advisory expanded to cover vulnerable industrial programmable logic controllers.
On July 26, 2026, hackers initiated coordinated cyber attacks on local municipal water utilities.
On July 27, 2026, plants experienced operational technology outages and critical operational control disruptions.
On July 28, 2026, Minnesota IT Services activated state emergency cybersecurity incident response protocols.
On July 28, 2026, CISA published emergency guidance advising operators on isolating vital systems.
On July 29, 2026, state officials confirmed more than thirty community systems were impacted.
Federal lawmakers will debate mandatory municipal water utility cybersecurity regulations.
Local municipalities will upgrade industrial control network security defense postures.
Investigators will officially identify specific malicious threat actor attribution details.

News Intelligence

State emergency responses activated across multiple municipal water utility networks.
National critical infrastructure faces heightened regulatory scrutiny and defense hardening.
Minnesota municipal water utilities, local operators, and state residents impacted.
Official state cyber alerts and municipal drinking water updates prioritized.