Coordinated Cyberattacks Hit More Than 30 Minnesota Water Systems; Iran-Linked Actors Suspected

A coordinated series of cyberattacks struck operational technology at more than 30 municipal water and wastewater systems across Minnesota over the weekend of July 26-27, temporarily disrupting automated controls at several facilities and prompting a multi-agency investigation that has focused suspicion on Iran-affiliated hackers.

Minnesota IT Services confirmed the activity targeted the industrial control systems used to manage community water operations. In at least one case, the city of Braham was forced to take a municipal well and water treatment plant offline for roughly 90 minutes to two hours while operators isolated the compromised systems, restored backups, and resumed operations. Other utilities shifted to manual workarounds after remote sensors and telecommunications links between control systems and equipment were disrupted. Officials stated that drinking water quality remained unaffected and that no communities issued boil-water notices or advised residents to alter water use beyond temporary conservation requests in limited instances.

Four municipalities that have publicly acknowledged impacts include Braham, Plymouth, South St. Paul, and Maple Plain. State officials indicated the total number of affected systems exceeded 30, with some assessments citing approximately 36. The FBI has reported related malicious cyber activity against water and wastewater utilities in at least seven states, though Minnesota experienced the most concentrated and publicly detailed incidents.

Investigators and intelligence assessments have identified Iran-linked actors as the leading suspects. A memo circulated among members of the Water Information Sharing and Analysis Center referenced findings from the Minnesota Fusion Center linking the activity to a broader campaign that the Cybersecurity and Infrastructure Security Agency previously attributed to Iran-affiliated hackers. U.S. and state officials familiar with the probe have described the attacks as “likely” the work of Iranian state-sponsored or Iran-aligned groups, citing the absence of ransom demands, the focus on disruption of operational technology, and consistency with prior Iranian targeting of U.S. critical infrastructure, particularly programmable logic controllers used in water systems. Cybersecurity researchers have noted operational patterns resembling those of groups such as CyberAv3ngers, which has a history of probing small water utilities.

Attribution remains preliminary as forensic analysis continues. Officials have cautioned that additional technical evidence could refine or alter the assessment, and some have noted the theoretical possibility that another actor sought to mimic Iranian tactics. The timing coincided with heightened U.S.-Iran tensions and followed recent CISA advisories warning of ongoing Iranian-affiliated targeting of internet-exposed industrial control devices in the water, energy, and government sectors.

Minnesota IT Services activated its cybersecurity incident response protocols, sharing intelligence with federal partners including the FBI and CISA, assisting affected communities in restoring operations, and working to harden defenses. The agency emphasized that cyberattacks on critical infrastructure demand coordinated action across state and federal levels. No evidence has emerged of physical damage to equipment or contamination of water supplies, but the incidents have underscored the vulnerability of smaller municipal systems that rely on remotely accessible operational technology.

Federal authorities continue to investigate the full scope of the activity and any connections to similar incidents elsewhere. Utilities nationwide have been urged to review and reduce internet exposure of industrial control systems in response to the Minnesota events and the accompanying warnings.