Advertisement Subscribe to our daily newsletter. Subscribe Close Cybersecurity Coordinated cyberattack disrupts water utilities in 30+ Minnesota communities A cyberattack of undetermined origin disrupted water treatment plants in at least 30 communities in Minnesota, according to the state's technology bureau. By Colin Wood July 28, 2026 Listen to this article 0:00 Learn more. This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. (Getty Images) More than 30 Minnesota communities saw their water and wastewater utilities disrupted by a coordinated cyberattack on Sunday and Monday, the state’s technology bureau announced Tuesday. Among those was the City of Braham, a community of 1,700 people that brands itself the “Homemade Pie Capital of Minnesota.” Braham officials on Monday morning announced on the city website that its water plant was “offline for an unknown reason” and asked its residents to minimize water use because the city water tower held only a “limited quantity.” A second notice later that day noted that the plant was back online, explaining that the outage had been the result of “a malicious cyber-attack of computerized operating systems by unknown actors.” A spokesperson from Plymouth, a Minneapolis suburb of about 80,000 people, explained in an email that the city’s IT division “disconnected the affected equipment from the network to stop the cyberattack and avoid any potential retargeting while the equipment is reconfigured.” In Plymouth’s case, the attack was limited to “equipment connected via cellular communications” at two city water towers and “multiple” lift stations. As in other communities, the official said water quality was unaffected — “the water is safe and there is no need for the public to adjust consumption.” Minnesota Information Technology Services, the state technology agency, said its response efforts have included “sharing threat intelligence, providing guidance on response efforts and best practices, and helping affected utilities contain, investigate, and remediate damages from the attack.” The agency said it’s working with numerous other agencies, including its own public safety and health departments, and a state fusion center, along with federal agencies such as the Cybersecurity and Infrastructure Security Agency, the Environmental Protection Agency and FBI. John Israel, Minnesota’s chief information security officer, is quoted in a press release as saying that the “whole-of-government response” worked as intended, helping “prevent more serious impacts to critical services.” Advertisement The Minnesota state government and several local governments contacted for this story declined to comment on who attacked the state’s water utilities, though Iran is a reasonable guess. CISA and a cohort of other federal agencies last week updated an advisory “urgently” warning the nation of ongoing attempts by Iranian hacking groups, such as CyberAv3ngers, to target internet-connected operational technology devices, including programmable logic controllers. That warning “should give everyone nightmare fuel,” said Joshua Corman, an executive in residence at the Institute for Security and Technology, a nonprofit think tank focused on issues of national security and global stability. There were also the U.S. strikes this month along Iran’s southern coast, near the Strait of Hormuz, that destroyed a water facility and cut off water access to more than 20,000 people as temperatures rose above 100 degrees Fahrenheit. The following day, the hacker group Hanzala claimed it had breached water utility systems in several California cities — including Bakersfield, Chico, Salinas and Stockton — as a warning to Washington. The group said it had restrained itself this time from disrupting the California communities’ water supplies. “We have at least two [adversaries] whose motivation is not to steal information or to monetize their access, but rather to disrupt and destroy at a time and place of their choosing,” Corman, who heads an initiative at IST called UnDisruptable27 , which aims to help water utilities improve their preparedness, said in an interview. “We are in a new place where we were always prone, we were always prey, but now they have an appetite to disrupt and destroy.” Corman said the other key adversary, China, is unlikely to direct its military to poison Americans by hacking water plants, “but a different predator might.” TJ Sayers, senior director of threat intelligence at the nonprofit Center for Internet Security, affirmed that the Minnesota attacks have not yet been attributed to any particular party, and that “it is unclear” whether the attacks involved the programmable logic controllers CISA warned about. “Offense cyber activity of this nature is expected to greatly accelerate in the short-term with the continued release of frontier AI models, with a plateau expected in the mid to long-term as those same models are used to harden new and existing infrastructure code,” Sayers wrote in an emailed statement. Sayers also noted that, of the numerous nation-state attacks on U.S. water facilities in recent years, none has documented “major downstream health impacts.” U.S. water utilities are a highly distributed network of some 150,000 to 170,000 systems, many of them small, rural and with few resources to defend themselves against cyberattacks or other disruptions. The EPA in 2024 warned that more than 70% of water systems were failing to comply with a provision of a 2018 law requiring them to develop or update risk assessments and emergency response plans, and to certify them with the environmental agency. An audit of 1,000 water systems serving 193 million people found 97 systems with critical- or high-risk vulnerabilities. Advertisement The national cyber drill, an annual event hosted by the EPA’s Office of Water Emergency Response and Cybersecurity, which is designed to boost emergency readiness, this month saw “a really tiny participation rate,” said Corman, the IST executive. He said the event asked participants who could operate their facilities for one day without their Supervisory Control and Data Acquisition, or SCADA, systems, the systems used to remotely monitor and control their plants. The answer, he said, was “not that many.” As many water utilities continue on unprepared, attackers are equipping themselves with more powerful tools. Corman said frontier AI models are allowing malevolent groups to craft surprisingly plausible attack plans that could be carried out against utilities that had been outmatched to begin with. He urged the public and policymakers to update their mental models of what’s possible: “We have an unhealthy and unsound assumption that our stuff isn’t connected to the internet. And it’s not merely water. Water is life.” Corman said he’s especially worried about how an attack against a water utility could affect community hospitals, large consumers of water that could run out of reserves within “two to four hours” — “Many people could die in the hospitals that depend on that water very quickly.” Written by Colin Wood Colin Wood is StateScoop's editor in chief. Contact him at colin.wood@statescoop.com or cwood.64 on Signal. In This Story China cyberattack cybersecurity government technology Iran Minnesota technology news water utility Share Facebook LinkedIn Twitter Copy Link Advertisement Advertisement More Like This California’s cybersecurity chief to step down after 7 years By Sophia Fox-Sowell Cyberattack against Maine telecom disrupted municipal internet service By Colin Wood Police AI platform uses ‘Easter eggs’ to verify human review By Keely Quinlan Advertisement Advertisement More Scoops (City of Minot) Water treatment plant in North Dakota suffered ransomware attack A ransomware attack last month forced operators of a water treatment facility in Minot, North Dakota, to revert to manual processes while a back-up server could be… By Colin Wood (Getty Images) FLOWS Act would fund cyber upgrades for rural water utilities By Sophia Fox-Sowell The Bay Park Sewage Treatment Plant hums along in East Rockaway, New York, on July 1, 2019. (John Keating / Newsday RM via Getty Images) New York unveils new cyber regulations for water treatment facilities By Colin Wood Iran war will bring wave of ‘low-level cyber activity,’ says intelligence group By Colin Wood New York proposes stronger cyber controls for water utilities By Colin Wood Minnesota’s new tracker shows how axed federal funding disrupts state services By Keely Quinlan ‘Critical’ cyber vulnerabilities found in many water utilities, warns EPA inspector general By Colin Wood Latest Podcasts It’s getting really hot. How can state and local governments mitigate the negative effects? AI-charged cyber threats are especially tough for small organizations How New Jersey’s new tech chief will support governor’s platform of ‘making government better’ Which state does New Jersey’s CTO hail from? State Pennsylvania Gov. Josh Shapiro announces $125M startup accelerator California names new state chief digital products officer Idaho names interim chief information officer Digital identity, IT modernization and procurement feature in California's new budget City ‘Technology is the easy part’: Washington, D.C., turned to collaboration, data governance for America 250 How San José trained 1,000 city employees to build their own AI tools Dallas deploys new digital kiosks as FIFA World Cup kicks off Dallas launches new resource page ahead of FIFA World Cup Cybersecurity 'Integrated' cyber and physical attacks concerned FIFA planners Arizona's new regional cyber center a 'force multiplier' for local governments, students Washington state CISO announces retirement from government State, local cyber grant funding can't be used on 'bundled' services from membership groups, FEMA clarifies Modernization 'Trust-first' data-sharing can better connect young mothers