07/31/2026

Cyberattacks target water utilities in Minnesota, disrupting OT operations and triggering multi-agency cyber response

Industrial Cyber

Four Minnesota cities, Plymouth, South St. Paul, Maple Plain, and Braham, all reported cyberattacks on their water utility systems starting Sunday night. Disruptions have been reported across automated control systems at water utilities in Braham, South St. Paul, Plymouth, Maple Plain, and St. Cloud, Minnesota, forcing operators at multiple facilities to switch to manual operations starting Sunday night. In Braham, the attack shut down the water treatment plant for less than two hours before crews restored service. Officials said water quality and public safety were unaffected across all the targeted cities. 

It remains unclear whether a single actor is behind all the incidents or whether Minnesota’s water infrastructure is being deliberately targeted.

As the investigation continues, the Minnesota IT Services (MNIT) said it is sharing threat intelligence and indicators of compromise, coordinating technical response activities, and providing cybersecurity expertise to affected communities. Response involves agencies including the CISA (Cybersecurity and Infrastructure Security Agency), the FBI (Federal Bureau of Investigation), the U.S. Environmental Protection Agency, the Minnesota Department of Health, and local water utilities.