Coordinated Cyberattack Strikes Over 30 Minnesota Water Utilities

A coordinated cyberattack struck operational technology systems at more than 30 community water utilities across Minnesota on July 26 and July 27, 2026. Minnesota IT Services confirmed the security breach in an official statement and activated emergency cybersecurity incident response protocols to contain the threat and secure critical infrastructure. The Minnesota Department of Health coordinated directly with the impacted municipal water systems to monitor public safety and protect public health. State officials confirmed that no city requested residents to alter drinking water consumption, and initial assessments indicated no loss of water or wastewater service continuity. Four affected municipalities publicly disclosed details regarding the incident, including Braham, Plymouth, South St. Paul, and Maple Plain. Federal cybersecurity agencies responded alongside state entities. On July 28, the Cybersecurity and Infrastructure Security Agency, alongside international partners from Australia, the United Kingdom, and Canada, published emergency guidance titled CI Fortify to advise critical infrastructure operators on isolating essential operational technology networks from broader enterprise connections. Security researchers from Tenable indicated that the timing and tactics mirror prior campaigns attributed to the Iran-linked threat group CyberAv3ngers, which has historically targeted small municipal water utilities and energy infrastructure by exploiting exposed programmable logic controllers and insecure remote-access tools such as TeamViewer and AnyDesk. Minnesota IT Services Assistant Commissioner and State CISO John Israel emphasized that safeguarding critical infrastructure necessitates a comprehensive, multi-agency response model. Investigations remain ongoing as state and federal teams analyze compromised control systems, examine log files, and assist local utilities in reinforcing digital defenses against further malicious activity.