Minnesota officials say more than 30 community water systems were hit by a 'coordinated cyberattack' on 26 and 27 July, triggering a statewide emergency response that now includes the FBI.
The attacks, which struck operational technology that helps control pumps, wells and treatment equipment, affected utilities across multiple cities in Minnesota.
On Sunday and Monday, systems in places including Braham, South St Paul, Maple Plain and Plymouth reported unexplained outages or disruptions before confirming a malicious cyber incident.
State technology agency Minnesota IT Services, known as MNIT, has activated its cyber incident response teams and is working with federal partners to contain the damage. The Minnesota water systems hack is being treated as an ongoing threat rather than a one‑off glitch.
Authorities continue working around the clock to restore normal manual procedures and harden vulnerable digital networks against future malicious intrusions.
Minnesota Water Systems Cyberattack Triggers Statewide Response
MNIT confirmed that it had immediately activated the state's cybersecurity incident response capabilities once the cyberattacks on the water systems were detected.
In a statement, the agency said specialist teams were now sharing threat intelligence, providing guidance and helping local utilities 'contain, investigate and remediate' the damage. They are also monitoring for any related malicious cyber activity and coordinating closely with federal cybersecurity partners.
'Cyberattacks against critical infrastructure require a coordinated, whole‑of‑government response,' John Israel, MNIT assistant commissioner and Minnesota's chief information security officer, said in a written statement on 28 July.
'MNIT is working side by side with our partners to share intelligence, support affected communities and help utilities restore operations safely while strengthening defences against future attacks.'
According to MNIT, detailed technical information about the breach methods and specific vulnerabilities exploited is being withheld for now to avoid helping copycat attackers.
The FBI has acknowledged the attack on the Minnesota water systems and confirmed that agents are in direct contact with victims 'to resolve the matter.'
Officials have not said whether they believe the threat originates from criminal hackers or a state‑linked group, nor have they disclosed whether any ransom demands were made. As of this writing, nothing is confirmed yet.
How the Minnesota Water Systems Cyberattack Played Out on the Ground
The first hints of trouble emerged publicly on the morning of 27 July, when several Minnesota cities began reporting unexplained issues at their water facilities.
In Braham, officials said around 9.34 a.m. local time that the city's water plant had gone offline for an unknown reason and that crews were working to fix it. By 11.25 a.m., the city confirmed that the outage was the 'result of a malicious cyber‑attack of computerised operating systems by unknown actors.'
According to Braham's statement, the hackers did not alter or damage the physical plant or water quality. Instead, they shut down the operating controls that manage the well and treatment plant, effectively turning off the system remotely. The city noted that at least four other communities had been hit with the same result.
South St Paul reported that it had identified a 'cybersecurity incident' affecting technology that supports parts of its water utility system on the morning of 27 July. The city said the incident disrupted certain automated controls, but contingency procedures allowed public works staff to maintain normal water and wastewater operations.
In Maple Plain, officials similarly announced that a cyber incident had impacted some of its water utility technology, but staff were able to keep services running using back‑up procedures.
In Plymouth, authorities said an issue, suspected to be a cyberattack, was affecting communications at two of the city's water towers and multiple lift stations. The outage began overnight on 26 July and was limited to equipment connected via cellular communications.
'Water levels and water quality are unaffected, the water is safe and there is no need for the public to adjust consumption,' the city said in a statement, adding that crews had continued operating as normal through manual procedures.
MNIT later confirmed that Minnesota water systems had been targeted in a broader 'coordinated cyberattack' that affected more than 30 community utilities across the state.
State investigators are now assessing each affected system to determine what was accessed, what was shut down and what, if anything, was altered.
Minnesota Water Systems Hack Highlights Wider Critical Infrastructure Threats
The Minnesota water systems cyberattack has landed in a climate of heightened concern about digital threats to critical infrastructure across the United States.
Federal agencies, including the Environmental Protection Agency, have repeatedly warned that water and wastewater systems are being probed and attacked by foreign actors, among them Iran's Islamic Revolutionary Guard Corps and state‑sponsored groups linked to Russia and China.
An advisory issued by the Cybersecurity and Infrastructure Security Agency on 7 April warned that Iranian‑affiliated hackers were targeting internet‑facing programmable logic controllers, industrial computers that interact directly with pumps, valves and other machinery, manufactured by Rockwell Automation.
A 22 July update to that advisory expanded the warning to include devices made by Schneider Electric, Siemens and potentially other manufacturers, suggesting a broader, more ambitious campaign against the digital backbone of water and power systems.
Commenting on that update in a 27 July blog post, Joe Slowik, director of threat research and cyber engineering at cybersecurity firm Dataminr, said CISA's reporting showed a 'worrying expansion' in Iran‑linked targeting of critical infrastructure in the US.
Extending the activity to additional equipment lines and coupling it with 'process manipulation and safety degradation' enabled scenarios with real‑world physical impact, he warned.
While officials have not linked any foreign group directly to the Minnesota water systems incident, cyber specialists say the pattern looks uncomfortably familiar. Targeting operational technology that runs wells, towers and lift stations, but leaving water quality untouched, can be read as a test of access and leverage rather than an immediate attempt to poison supplies. Or it could simply be that the attackers did not yet have the capability to go further.
MNIT announced on 28 July that the investigation into the Minnesota water systems cyberattack remains active as teams assess the extent of the impact and help local utilities restore operations.
According to the agency, the initial wave of attacks targeted the control technology used by community water systems rather than the physical water supply itself.
The Minnesota Department of Health has been working directly with affected operators and has said that public health 'remains protected.'
Minnesota IT Services has declined to share further technical detail beyond confirming that there have been no requests from cities for residents to change their drinking water usage.
State and federal agencies, including the FBI, remain embedded with local utilities as they work to restore all automated systems to normal and to harden networks against the next probe.
Authorities have not identified who is behind the attacks or how intruders gained access to the systems.
Federal authorities continue examining technical logs to determine whether the operation served as a reconnaissance probe or a precursor to larger digital disruptions.
Whether investigators can pin down who sat behind the keyboard, and whether this was a warning shot or part of a larger campaign, will determine how worried the rest of the country should be.
