A synchronized cyberattack disrupted operational technology systems at more than 30 municipal water and wastewater utilities across Minnesota over the weekend, forcing multiple communities to switch to manual operations and marking one of the largest coordinated assaults on U.S. water infrastructure to date.
The attacks, which occurred between July 26 and July 27, 2026, targeted SCADA communications, cellular telemetry controllers, and treatment control systems in municipalities including Plymouth, South St. Paul, Maple Plain, and Braham, according to an analysis published by industrial cybersecurity firm Shieldworkz.
In Braham, a city of roughly 1,700 residents, operators temporarily lost automated control of well pumps, prompting officials to issue water conservation notices while staff worked to restore manual overrides. The plant was back online within 90 minutes. In Plymouth, a Minneapolis suburb of approximately 80,000 people, the attack was confined to cellular-connected equipment at two water towers and multiple lift stations. City IT staff disconnected affected hardware from the network to halt the intrusion.
Minnesota Information Technology Services (MNIT), the state’s technology agency, confirmed Tuesday that it had activated a statewide incident response protocol alongside the Minnesota Department of Health, the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the Environmental Protection Agency. State officials emphasized that water quality was never compromised and that no public health impacts were reported.
A New Scale of Threat
The incident stands out not for its sophistication, but for its scope. Rather than breaching a single facility, the campaign achieved concurrent impact across more than 30 distinct local infrastructure entities within a 48-hour window-suggesting exploitation of a shared dependency, such as a compromised managed service provider (MSP), cellular telemetry gateway, or centralized remote access platform.
“This reflects deliberate campaign planning,” the Shieldworkz analysis notes. “Threat actors either built an inventory of vulnerable water infrastructure credentials/devices over months or targeted a central choke point.”
The Minnesota attacks come amid heightened warnings from federal agencies about nation-state interest in U.S. water systems. CISA and partner agencies issued an advisory last week cautioning that Iranian hacking groups, including CyberAv3ngers, have been actively targeting internet-connected operational technology devices such as programmable logic controllers (PLCs). The timing also follows recent U.S. military strikes near Iran’s southern coast, after which a group calling itself Hanzala claimed to have breached water utility systems in several California cities.
Technical Breakdown
Affected utilities reported a range of disruptions: severed cellular telemetry links, disabled remote SCADA access, and in Braham’s case, a temporary loss of automated pump controls. The analysis suggests several plausible initial access vectors:
- Compromised third-party integrator: Small municipal utilities frequently outsource SCADA and telemetry maintenance to regional engineering vendors. A breach of a single MSP’s central management portal could enable bulk command pushes to dozens of client endpoints.
- Mass exploitation of cellular gateways: Direct internet exposure of cellular modems and routers with default credentials or unpatched remote execution flaws could allow automated, wide-scale access.
- Valid account abuse: Theft or misuse of shared administrative credentials used by maintenance contractors across multiple sites.
The analysis maps observed activity to several MITRE ATT&CK for ICS techniques, including External Remote Services (T0822), Loss of Control (T0806), and Loss of Availability (T0826). Notably, the report classifies the deployment of custom destructive OT malware as “unlikely,” since systems recovered rapidly via manual reboots without hardware replacement. Financially motivated ransomware was also deemed unlikely, as no ransom notes or encryption payloads were reported.
Attribution Remains Uncertain
State and federal officials have not publicly attributed the Minnesota attacks to any specific actor. The Shieldworkz assessment evaluates multiple possibilities:
- Iranian state-aligned actors (CyberAv3ngers): Rated a medium-high fit based on historical targeting of water utilities via exposed PLCs and cellular networks, though the coordinated multi-site nature suggests higher operational maturity than typical hacktivist operations.
- Russian state-sponsored actors (Sandworm/GRU): Rated a high fit given demonstrated capabilities in OT disruption, though the absence of destructive payloads could indicate an early-stage campaign or proxy operation.
- Cybercriminals: Rated a low fit due to the confirmed absence of financial extortion motives.
Structural Vulnerabilities Exposed
The incident highlights persistent weaknesses in the U.S. water sector, which comprises an estimated 150,000 to 170,000 systems-many of them small, rural, and under-resourced. The EPA warned in 2024 that more than 70% of water systems were failing to comply with a 2018 law requiring updated risk assessments and emergency response plans.
Unlike the bulk electric power grid, which operates under mandatory NERC CIP cybersecurity standards, most water utilities lack equivalent regulatory requirements. They frequently rely on single IT/OT staff members, legacy control hardware, and third-party contractors using shared credentials across multiple municipal clients.
“The water and wastewater sector remains uniquely vulnerable within critical infrastructure,” the analysis states. “Breaking into a small water utility yields high psychological impact and news coverage with minimal operational friction.”
Recommendations and Response
The report outlines several defensive priorities for the sector, including auditing all third-party remote access to OT environments, enforcing multi-factor authentication for vendor connections, isolating cellular modems from direct internet exposure, and regularly testing manual operational overrides. It also urges incident responders to preserve cellular router logs prior to rebooting compromised equipment.
For organizations seeking structured response guidance, Shieldworkz has published a Water & Wastewater Cyber Incident Response Plan, aligned with NIST SP 800-61 and IEC 62443 frameworks. The guide emphasizes separating IT and OT containment actions, classifying incident severity by public-health consequence rather than generic IT impact, and treating manual-operations readiness as a core control rather than a fallback option.
As one analyst quoted in the assessment put it: “We are in a new place where we were always prone, we were always prey, but now they have an appetite to disrupt and destroy.”