Coordinated cyberattack hits more than 30 Minnesota water utilities

A coordinated cyberattack on July 26 and 27 hit operational technology (OT) systems at more than 30 community water utilities across Minnesota, prompting an immediate response from Minnesota IT Services (MNIT) to contain the threat.

MNIT confirmed the attack in a statement published July 28 and said it activated its cybersecurity incident response capabilities as soon as it learned of the intrusion. The agency has since been working with a broad set of partners to investigate the attack, support the affected communities, and shore up the security of the state’s infrastructure.

“Cyberattacks against critical infrastructure require a coordinated, whole-of-government response,” said John Israel, MNIT Assistant Commissioner and Minnesota’s CISO. “MNIT is working side by side with our partners to share intelligence, support affected communities, and help utilities restore operations safely while strengthening defenses against future attacks.”

The investigation remains active, and responders continue to assess which systems were affected. The Minnesota Department of Health is working directly with the impacted water systems to help protect public health, and so far no Minnesota city has asked its residents to change how they use their drinking water.

Four cities have come forward publicly about the attack, Braham, Plymouth, South St. Paul, and Maple Plain.

The City of Maple Plain noted in a statement that some details about the incident and the response cannot be shared right now, since releasing them could raise risks to infrastructure or interfere with the cybersecurity work underway. Officials added that more information would follow once it is safe to share.

“At this time, there has been no disruption to water or wastewater service, and there is no indication that the safety or quality of the City’s drinking water has been affected,” city officials said.

New federal guidance and a suspected Iranian link

On July 28, CISA, with Australia’s Signals Directorate, the UK’s National Cyber Security Centre, and Canada’s Centre for Cyber Security, published CI Fortify – Advice for Isolating Vital Systems, guidance advising infrastructure operators to isolate essential OT systems from the rest of their networks, a step meant to keep services running even if a breach occurs.

“CISA urges OT owners and operators to maintain robust isolation and recovery plans so that essential services can continue under degraded conditions, enabled through either manual or alternative SCADA paths. Through proactive planning and practice, we can strengthen critical infrastructure defenses against state-sponsored threat actors,” noted Chris Butera, CISA’s Executive Assistant Director for Cybersecurity.

Although officials have not publicly attributed the attack to any actor, security researchers at Tenable suspect the Iran-linked group CyberAv3ngers, based on patterns consistent with its past targeting of small water utilities.

“The timing of the Minnesota attacks is significant,” researchers said. “CISA updated Advisory AA26-097A on July 22, just four days before the attacks began, warning that Iranian-affiliated actors had been compromising internet-connected PLCs across U.S. water, energy, and government sectors.”

According to Tenable, CyberAv3ngers has repeatedly compromised small water utilities and municipal facilities, a pattern the firm calls structural rather than coincidental, tracing it to organizations that run OT environments through consumer remote-access tools such as TeamViewer and AnyDesk, or expose PLC interfaces directly to the internet.

“Small utilities typically lack dedicated OT security staff and operate under constrained budgets that make comprehensive security architecture difficult to implement,” Tenable noted.

Help Net Security wrote about a separate but related problem facing the broader OT sector, a shortage of engineers who understand both control systems and networks deeply enough to secure them, with much of that expertise aging into retirement faster than utilities can replace it.