Coordinated cyberattack disrupts more than 30 Minnesota water systems (2026)

Over the weekend of 26–27 July 2026, a coordinated cyberattack struck the operational-technology (OT) systems of more than 30 Minnesota municipal water and wastewater utilities at roughly the same time. By Monday morning, 27 July, city officials across the state began discovering outages and disruptions to the automated controls that run treatment and distribution, and Minnesota IT Services (MNIT) activated a statewide cybersecurity response to support the affected communities.

What happened

The cities of Plymouth, South St. Paul, Maple Plain, and Braham publicly confirmed that they were among the targets; MNIT classified the remaining systems as non-public while the investigation continued. Braham's water plant went offline, prompting the city to ask residents to minimise water use until treatment resumed. Plymouth reported communications problems at two water towers and multiple wastewater lift stations but continued operating manually, while South St. Paul and Maple Plain maintained service after their automated utility controls were affected — Maple Plain declaring a local state of emergency to support its response.

Crucially, the utilities reported no confirmed contamination of drinking water: operators fell back to manual control of pumps and treatment while they isolated and assessed the compromised systems. The attack targeted the computerised controls rather than the physical treatment process itself.

Attribution and wider campaign

A preliminary assessment by U.S. investigators suggested that an Iran-nexus actor was probably responsible, while stressing that the judgement was tentative and could change. The Minnesota incident was subsequently linked to a broader campaign affecting utilities across several U.S. states, and the FBI and Environmental Protection Agency issued warnings urging water and wastewater operators nationwide to review the exposure of their OT and remote-access systems.

Why it matters

The Minnesota case is a stark reminder that small municipal utilities — often running lean IT teams and internet-exposed industrial controls — sit on the front line of critical-infrastructure security. A single coordinated campaign was able to disrupt automated operations across dozens of communities at once, and only manual fallback procedures and rapid state coordination prevented the disruption from reaching customers' taps.