Minnesota water systems hit in coordinated cyberattack

Minnesota IT Services said publicly that a coordinated cyberattack affected more than 30 community water systems in the state on July 26 and 27, 2026. In Michigan, nine water systems were also reported hit. The state IT agency told The Hacker News that no ransom demand was tied to the incident.

What happened in Minnesota?

The first public reports came from Braham, Maple Plain, South St. Paul and Plymouth, cities that reported incidents in their municipal water systems and activated contingency measures to keep essential services running. In Braham, the treatment plant was temporarily taken offline after attackers disabled operational controls, prompting officials to ask residents to reduce water use until the system was restored.

In Plymouth, the attack caused cellular communications problems that affected water towers and sewer lift stations, according to reports cited by Tecmundo from local statements. South St. Paul and Maple Plain also saw ongoing failures in automated water and sewer systems, although service continued thanks to contingency plans.

What was the technical scope and official response?

Excélsior, citing a MNIT statement, added that the technical target was programmable logic controllers, or PLCs, and human-machine interfaces, HMIs, key parts of the operational technology used in water plants. The same report said the Minnesota Department of Health is taking part in the investigation to assess local impacts.

MNIT also advised drinking water and wastewater operators to identify operational technology equipment with internet access and review remote access capabilities. USA Today said the response involves coordinated state, federal and local authorities, with cybersecurity teams supporting affected communities while they assess the impact on operational technology.

According to Al Jazeera, most of the confirmed attacks involved technology used to remotely monitor and control equipment in water systems, and as of Thursday that week there were no active requests for residents to change their water use.

What did the FBI and EPA say?

NBC News reported that the FBI and EPA issued a public notice saying that cyberattacks against municipal water systems had been reported that week in at least seven states, with malicious activity degrading water operations in some cases. The notice also said malicious cyber actors were targeting specific brands of control systems used by municipal drinking water and wastewater services in the United States.

Yahoo News said attackers remotely accessed internet-exposed devices, changed IP addresses and passwords, and in some plants caused the loss of monitoring and control capabilities. The joint notice also urged all plants to harden access controls.

Attribution remains open. NBC News said the case has characteristics associated with Iran-backed hackers, though without formal attribution. La Tercera reported that investigators provisionally believe the attack could be the work of Iranian hackers, but authorship has not been officially confirmed. ABC News and Al Jazeera said the investigation is still ongoing. The Register, meanwhile, said Tenable researchers suspect the CyberAv3ngers group, linked to Iran, although neither state nor federal authorities have made a definitive public attribution.

What other states were affected?

Univision reported that Michigan said cyberattacks hit nine water systems in the state, adding to the Minnesota case, and that a local official said all systems were operating safely despite the attacks. El Nuevo Día quoted Dale George, spokesperson for Michigan's Department of Environment, Great Lakes and Energy, as saying there were no impacts that raised public health concerns.

The FBI is still investigating the Minnesota and Michigan attacks together as part of a broader campaign against water infrastructure, while CISA issued a warning tied to the rise in attacks against water utilities two days after MNIT reported the Minnesota case.