Cyberattack targets Minnesota water systems

What This is

• A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water and wastewater systems around July 26–27.
• The attack hit industrial-control devices used to run and monitor treatment and pumping, including programmable logic controllers (PLCs) and human-machine interfaces.
• Some utilities were locked out or lost remote communications and had to switch to manual operations, and a few sites briefly went offline.
• Officials said there was no evidence the drinking water was contaminated, and residents generally were not asked to change water use.
• Minnesota IT Services activated a statewide cyber response and is working with federal partners including CISA, the FBI, and the EPA to contain the incident and help utilities recover.
• Investigators have not publicly named a culprit, but U.S. officials say the activity looks consistent with earlier incidents tied to Iran-linked hackers and remains under review.
• CISA warned that hacks of water systems are rising and urged utilities to remove internet-exposed control devices, change default passwords, patch known flaws, and improve monitoring.
• A leaked WaterISAC memo and a Minnesota Fusion Center alert also linked the wave to Iran-affiliated hackers, though officials have not confirmed that attribution publicly.

Why This Matters

• Water systems are critical infrastructure, so even short disruptions can create public health risks and panic.
• If a foreign-linked group is responsible, it raises the chance of retaliation cycles and broader state-to-state cyber conflict.
• The incident highlights how older industrial-control gear and remote access can leave small towns exposed with limited staff and budget.
• The response will shape how aggressively governments push utilities to remove control systems from the open internet and improve basic cyber hygiene.