Key Takeaways
- More than 30 Minnesota community water systems experienced a coordinated cyberattack on July 26‑27, 2026, affecting operational technology.
- Impacts ranged from plant shutdowns and communication failures to altered automated controls; some utilities continued manual operation.
- Minnesota IT Services (MNIT) led a multi‑agency response involving CISA, EPA, FBI, and state partners to contain the incident and share threat intelligence.
- Investigators identified common timing, access methods, and targeted infrastructure but have not yet attributed the attacks to a specific actor or confirmed data theft.
- The attack pattern resembles earlier warnings about Iranian‑affiliated groups targeting programmable logic controllers (PLCs) from Rockwell, Schneider, Siemens, and similar vendors.
- Tenable analysts noted the tactics align with the CyberAv3ngers threat ecosystem linked to Iran’s Islamic Revolutionary Guard Corps Cyber‑Electronic Command (IRGC‑CEC).
- CISA issued defensive guidance, recommending logging cellular modem connections, restricting PLC access, validating backups, and inspecting project files for unauthorized changes.
- As of July 29, 2026, the investigation remains active, with ongoing assessment of affected systems and containment efforts.
Overview of the Coordinated Cyberattack
On July 26 and 27, 2026, a synchronized cyber intrusion targeted the operational technology (OT) of more than thirty community water systems across Minnesota. The assault disrupted supervisory control and data acquisition (SCADA) environments, programmable logic controllers (PLCs), and associated human‑machine interfaces (HMIs). While the exact payload varied, the common denominator was unauthorized access to critical control layers that regulate water treatment, storage, and distribution. The breadth of the impact prompted Minnesota IT Services (MNIT) to characterize the activity as a coordinated campaign rather than a series of isolated incidents.
Impacts on Specific Utilities
Several utilities publicly disclosed the consequences of the breach. In Braham, the water treatment plant went completely offline, prompting the city to urge residents to curtail water use until service could be restored. Plymouth reported cellular‑communication failures at two water towers and multiple wastewater lift stations; despite losing remote monitoring, operators shifted to manual control to keep processes running. South St. Paul and Maple Plain noted that automated utility controls were compromised, yet both maintained service continuity—Maple Plain even declared a local state of emergency to marshal additional resources for response and recovery. These varied outcomes illustrate how the attack’s effect depended on each system’s architecture, redundancy, and preparedness.
State and Federal Response Coordination
MNIT acted as the central hub for containment, investigation, recovery, and threat‑intelligence sharing. The agency convened a joint task force that included the Cybersecurity and Infrastructure Security Agency (CISA), the Environmental Protection Agency (EPA), the Federal Bureau of Investigation (FBI), and Minnesota’s own public‑safety and environmental departments. According to John Israel, MNIT assistant commissioner and state chief information security officer, the “whole‑of‑government” approach enabled rapid isolation of affected networks, prevention of further propagation, and dissemination of Indicators of Compromise (IOCs) to other utilities. The collaborative posture also facilitated the deployment of forensic tools and the establishment of a unified incident‑status dashboard.
Investigation Status and Outstanding Questions
As of the latest update, investigators have confirmed that the attacks shared consistent timing, access vectors, and targeted infrastructure types, supporting the coordinated‑attack hypothesis. However, MNIT has not disclosed the specific vulnerability exploited, the exact PLC or HMI models involved, or whether any data was exfiltrated. Attribution remains unresolved; officials have not linked the incidents to a single threat actor or stated definitively that a foreign government is behind them. The ongoing probe continues to analyze logs, malware samples, and network traffic to close these gaps while preserving the integrity of evidence for potential legal action.
Connection to Broader Threat Landscape
Four days prior to the Minnesota events, U.S. agencies issued an expanded warning concerning Iranian‑affiliated threat actors targeting internet‑facing PLCs from manufacturers such as Rockwell Automation, Schneider Electric, and Siemens. That advisory described observed behaviors including exfiltration and modification of project files, manipulation of HMI/SCADA displays, and deliberate disabling of shutdown and alarm logic. While state and federal officials have not formally tied the Minnesota breach to that campaign, analysts note striking similarities in timing, methodology, and the choice of OT targets. The alignment suggests the attackers may be leveraging known Iranian‑linked tradecraft, though definitive attribution is still pending.
Tenable’s Analysis and the CyberAv3ngers Link
Tenable’s senior staff research engineer, Scott Caveza, told The Hacker News that the tactics observed in Minnesota—such as unauthorized PLC access, HMI manipulation, and potential disruption of alarm logic—are consistent with the tradecraft historically associated with the CyberAv3ngers group and other IRGC‑CEC‑affiliated actors. Caveza emphasized that these groups have been targeting water and wastewater infrastructure since at least 2023, often exploiting weak remote‑access controls and insufficient network segmentation. Although Tenable stopped short of asserting responsibility, the analysis underscores that the Minnesota incident fits within a broader pattern of Iranian‑linked OT threats aimed at critical water services.
Defensive Guidance and Recommended Mitigations
CISA’s accompanying advisory provides sector‑wide defensive measures that Minnesota utilities and other critical‑infrastructure operators should consider. Key recommendations include: logging all cellular modem connections to detect anomalous telemetry; restricting PLC and HMI access to known, authorized systems via strict allow‑lists; regularly inspecting running project files for unauthorized alterations; validating backups before any restoration effort; and, where a controller possesses a physical mode switch, ensuring it remains in “run” mode only after verifying the integrity of its project files. Additionally, organizations are urged to segment OT networks from IT and corporate environments, enforce multifactor authentication for remote access, and conduct regular penetration testing focused on ICS protocols.
Current Status and Outlook
As of July 29, 2026, MNIT reported that the investigation remained active, with responders continuing to assess the extent of operational disruption across the affected water systems. Containment measures have been implemented, and utilities are gradually restoring full automated functionality while maintaining manual overrides where necessary. The incident serves as a stark reminder of the growing vulnerability of water‑and‑wastewater OT to sophisticated, state‑aligned cyber threats. Ongoing vigilance, adherence to CISA’s best‑practice guidance, and continued cross‑government collaboration will be essential to safeguard Minnesota’s critical water infrastructure against future attacks.