Key Takeaways
- More than 30 Minnesota community water systems were hit by a coordinated cyberattack on July 26‑27, 2025.
- Affected cities include Plymouth, South St. Paul, Maple Plain, and Braham; officials say drinking‑water safety was not compromised.
- Minnesota IT Services (MNIT) activated its cybersecurity incident‑response team and is working with federal and private‑sector partners to investigate and harden defenses.
- State officials emphasize that the incident underscores the value of prior investments in cybersecurity capabilities and inter‑agency coordination.
- Ongoing efforts focus on threat intelligence sharing, utility support, and strengthening the security posture of Minnesota’s critical infrastructure.
Overview of the Incident
On Tuesday, July 28, Minnesota officials announced that a “coordinated cyberattack” had targeted the technology systems of more than 30 community water utilities across the state. The attack unfolded over a two‑day window, beginning late on Sunday, July 26 and continuing through Monday, July 27. Although the breach disrupted certain operational technology components, state health and environmental agencies confirmed that there was no immediate threat to the safety or potability of the drinking water supplied to residents.
Timeline and Scope
The Minnesota IT Services (MNIT) cybersecurity unit first detected anomalous activity on the evening of July 26. By the morning of July 27, alerts had been issued to dozens of municipal water providers, prompting a rapid escalation of the state’s cybersecurity incident‑response plan. Over the ensuing 48 hours, affected utilities reported varying degrees of system interference, ranging from temporary loss of remote monitoring capabilities to forced shutdowns of supervisory control and data acquisition (SCADA) interfaces. No reports emerged of untreated water being released into distribution networks.
Affected Communities
Four municipalities—Plymouth, South St. Paul, Maple Plain, and Braham—were the first to publicly disclose the incident via press releases and social‑media updates. Each city emphasized that the impacts were “limited or mitigated” and that residents could continue normal water use without boil‑water advisories or usage restrictions. Subsequent disclosures from MNIT indicated that the total number of compromised systems surpassed 30, spanning rural towns, suburban districts, and smaller urban centers throughout Minnesota.
Official Statements
John Israel, Assistant Commissioner of Minnesota IT Services and the state’s Chief Information Security Officer, issued a formal statement highlighting the coordinated nature of the response. He noted, “Cyberattacks against critical infrastructure require a coordinated, whole‑of‑government response… Our response worked as intended, enabling agencies at every level of government to rapidly coordinate, contain the incident, and help prevent more serious impacts to critical services.” Israel also stressed that the episode validates Minnesota’s prior investments in cybersecurity infrastructure and inter‑agency partnerships.
State and Federal Response
Following the detection, MNIT activated its Cybersecurity Incident Response Team (CIRT) and invoked the Minnesota Critical Infrastructure Protection Plan. The state’s Department of Public Safety, the Minnesota Department of Health, and the Environmental Protection Agency (EPA) Region 5 were brought into the effort. Federal partners, including the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI’s Cyber Division, offered threat‑intelligence support and forensic assistance. Private‑sector cybersecurity firms specializing in operational technology (OT) were also engaged to help utilities isolate affected segments and restore normal operations.
Impact on Drinking Water Safety
Despite the technical disruptions, the Minnesota Department of Health (MDH) reported no requests from any municipality for residents to alter their drinking‑water consumption. Water quality monitoring continued uninterrupted at treatment plants, and operators maintained manual override capabilities to ensure that disinfection and filtration processes remained functional. MDH officials attributed the lack of health impact to the attack’s focus on IT and OT monitoring layers rather than on the physical treatment processes themselves.
Lessons from Past Cyberattacks
The Minnesota incident echoes a growing trend of cyber threats aimed at water and wastewater systems worldwide. Notable precedents include the 2021 Oldsmar, Florida water‑treatment plant hack, where attackers attempted to increase sodium hydroxide levels, and the 2020 ransomware attack on a South African water utility that disrupted billing and customer service. These events have highlighted vulnerabilities such as outdated SCADA software, insufficient network segmentation, and limited OT‑specific security training for utility staff.
Recommendations for Utilities
In the aftermath, cybersecurity experts urge Minnesota water utilities to adopt several best practices: (1) implement strict network segmentation between IT business systems and OT control systems; (2) enforce multi‑factor authentication for all remote access points; (3) conduct regular, OT‑focused penetration testing and red‑team exercises; (4) maintain up‑to‑date inventories of all connected devices and apply patches promptly; and (5) develop and test incident‑response playbooks that include clear communication protocols with state and federal agencies.
Future Preparedness and Investment
State officials have signaled that the attack will accelerate ongoing efforts to harden Minnesota’s critical infrastructure. Planned actions include expanding the MNIT Cybersecurity Grant Program to allocate additional funds for OT security upgrades, establishing a statewide Water‑Sector Information Sharing and Analysis Center (ISAC), and increasing joint training exercises that simulate cyber‑physical attack scenarios. Legislators are also reviewing proposals to mandate minimum cybersecurity standards for all public water utilities receiving state funding.
Conclusion
The coordinated cyberattack on Minnesota’s water systems serves as a stark reminder of the evolving threat landscape facing essential services. While the immediate impact on drinking‑water safety was negligible, the incident exposed gaps in OT defenses and underscored the necessity of a unified, well‑resourced cybersecurity strategy. By leveraging the lessons learned, strengthening partnerships across government, industry, and academia, and investing in resilient infrastructure, Minnesota aims to safeguard its water supplies against future cyber threats and ensure uninterrupted service for all residents.