Overview
- State technology officials say a coordinated cyber operation targeted operational-technology controls at more than 30 community water systems on Sunday and Monday, July 26–27.
- In one town, Braham, attackers shut down computerized operating controls and temporarily took a well and treatment plant offline before crews restored service using manual procedures.
- Plymouth, South St. Paul, Maple Plain and other municipalities reported disruptions to automated controls or cellular-linked equipment but said crews used contingency plans to keep water flowing.
- Minnesota IT Services activated a statewide response and is working with the FBI, the Minnesota Bureau of Criminal Apprehension, CISA and other partners to investigate; officials have not made a formal attribution.
- Federal advisories warn that internet-facing programmable logic controllers and cellular-connected remote assets are common entry points for attackers, which raises concern about similar risks at other U.S. water utilities.