Overview
- Minnesota IT Services says more than 30 community water systems were targeted in a coordinated cyberattack that affected operational technology used to run pumps, wells, towers and treatment controls on July 26 and July 27.
- At least four cities including Braham, Plymouth, South St. Paul and Maple Plain reported disruptions to automated controls or communications, and Braham briefly took its water plant offline after attackers shut down operating controls.
- Most utilities maintained service by switching to manual procedures or contingency plans and the Minnesota Department of Health has not reported any confirmed impacts to water quality or requests for residents to change water use.
- State teams activated a statewide cybersecurity incident response and are working with federal partners including the FBI and CISA to contain the incidents, investigate how attackers accessed cellular-connected field devices, and share technical intelligence.
- The attacks echo recent U.S. advisories warning that threat actors have been probing internet-facing programmable logic controllers and cellular links used in industrial control systems, though officials have not made any formal attribution.