Minnesota water systems hit in coordinated cyberattack

Minnesota IT Services publicly confirmed that a coordinated cyberattack affected more than 30 community water systems across the state on July 26 and 27, 2026. The state IT agency told The Hacker News that the incident was not tied to a ransom demand.

What happened in Minnesota

The first public reports came from Braham, Maple Plain, South St. Paul and Plymouth, cities that said their municipal water systems had been hit and that they activated contingency measures to keep essential services running. In Braham, the treatment plant was temporarily taken offline after attackers disabled operational controls, leading officials to ask residents to reduce water use until the system was restored.

In Plymouth, the attack caused cellular communications problems that affected water towers and sewer lift stations, according to reports cited by Tecmundo from local statements. South St. Paul and Maple Plain reported ongoing failures in automated water and sewer systems, although service continued thanks to contingency plans.

Technical scope and official response

Excélsior, citing a MNIT statement, added that the attack targeted programmable logic controllers, or PLCs, and human-machine interfaces, or HMIs, key components in water plant operational technology. The same report said the Minnesota Department of Health is part of the investigation to assess local effects.

MNIT also advised drinking water and wastewater operators to identify operational technology equipment with internet access and review remote access capabilities. USA Today said the response involves coordinated work by state, federal and local authorities, with cybersecurity teams supporting affected communities while the impact on operational technology is assessed.

According to Al Jazeera, most of the confirmed attacks involved technology used to remotely monitor and control water system equipment, and as of Thursday that week there were no active requests for residents to change their water use.

Federal investigation and attribution

NBC News reported that the FBI and the EPA issued a public notice saying that cyberattacks on municipal water systems had been reported that week in at least seven states, with malicious activity degrading water operations in some cases. The notice also said malicious cyber actors were targeting specific brands of control systems used by municipal water and wastewater utilities in the United States.

Yahoo News said the attackers gained remote access to internet-exposed devices, changed IP addresses and passwords, and in some plants caused the loss of monitoring and control capabilities. The joint notice also urged all plants to harden access controls.

Attribution remains open. NBC News said the case has characteristics associated with hackers backed by Iran, though there has been no formal attribution. La Tercera reported that investigators believe provisionally that the attack could be the work of Iranian hackers, but authorship has not been officially confirmed. ABC News and Al Jazeera both said the investigation is ongoing. The Register, meanwhile, said Tenable researchers suspect the CyberAv3ngers group, linked to Iran, although neither state nor federal authorities have made a definitive public attribution.

Other affected states

Univision reported that Michigan disclosed cyberattacks against nine water systems in the state, joining Minnesota, and that a local official said all systems were operating safely despite the attacks. El Nuevo Día quoted Dale George, a spokesperson for Michigan's Department of Environment, Great Lakes, and Energy, as saying there were no impacts that raised public health concerns.

The FBI is continuing its joint investigation into the Minnesota and Michigan attacks as part of a broader campaign against water infrastructure, while CISA issued an alert tied to the rise in attacks against water utilities two days after MNIT reported the Minnesota case.