Automated controls at 36 municipal water systems across Minnesota were knocked offline in a coordinated cyberattack suspected to involve Iran-linked hackers, forcing human crews in towns such as Braham to isolate equipment and restart critical machinery by hand.
It took roughly 90 minutes on Monday morning for staff in Braham, a town of around 1,700 people, to bring the local water plant back under manual control after its systems went dark, according to CBS Minnesota.
What Happened Inside the Water Plants
On 28 July, Minnesota IT Services disclosed the coordinated attack, confirming that hackers had targeted operational technology on 26 and 27 July, compromising the digital controls that run pumps, wells, water towers and wastewater lift stations rather than office computer networks.
The breach was first detected on Sunday, according to the state's chief information security officer, John Israel, who said that early alert allowed officials to warn other municipalities with similar vulnerabilities and mount a faster response.
In Plymouth, attackers compromised equipment connected through cellular communications at two water towers and several lift stations, prompting the city's IT team to disconnect the affected systems entirely and run operations by hand.
South St Paul activated its own contingency procedures, while Maple Plain went further and declared a local state of emergency, giving officials greater flexibility to marshal resources.
None of it involved a ransom note. However, officials have not yet confirmed whether any data was stolen. The absence of a financial demand has drawn particular attention from investigators.
Why Officials Suspect Iran
Cynthia Kaiser, a former senior FBI official, told the reporters that 'almost every initial assumption of attribution turns out to be true', pointing to the pattern of disruption without any financial motive as consistent with Tehran's documented interest in American water infrastructure.
Security researchers at Tenable separately flagged tactical similarities to CyberAv3ngers, a hacking group tied to Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command.
Whether that attribution holds up is still an open question. Officials have been careful to stress that the assessment remains preliminary and that someone impersonating Iranian hackers to stoke tensions cannot be entirely ruled out, though former intelligence officials consider that scenario unlikely.
A Minnesota state fusion center report ties the cyberattacks on 30+ Minnesota water utilities to Iranian-affiliated hackers, according to a water utility information sharing group's memo I obtained. https://t.co/32EpwxXIX5
— Andy Greenberg (@agreenberg at the other places) (@a_greenberg) July 30, 2026
How Minnesota's Water Systems Recovered
By Wednesday afternoon, Mr Israel confirmed there was no evidence that any of the breaches had contaminated drinking water or disrupted its delivery to residents.
Plymouth announced that communications with its water facilities had been fully restored and normal operations resumed, while Maple Plain lifted its local emergency once services stabilised. Minnesota IT Services said it was not aware of any municipality asking residents to change how they used tap water while the response continued.
The vulnerability at the heart of the intrusion is not new. Rockwell Automation programmable logic controllers, the kind used across many of these facilities, remain exposed through a flaw tracked as CVE-2021-22681, one for which no vendor patch currently exists.
An April advisory from the Cybersecurity and Infrastructure Security Agency had already warned that Iranian-affiliated actors were targeting these exact devices and that the warning came months before.
