Loading story…
A ransomware attack compromised a server tied to the Minot Water Treatment Plant in North Dakota, affecting the plant’s SCADA environment and forcing operators to switch to manual procedures for about 16 hours. City officials said the plant and related water system facilities remained operational and the water supply stayed safe throughout the incident. The facility serves Minot and surrounding communities through the Northwest Area Water Supply, reaching roughly 80,000 people.
Officials said they unplugged the affected server after discovering the intrusion on March 14 and found only a ransom letter displayed on the screen, with no direct contact from the attackers and no specified payment demand. The city did not pay a ransom, recovery is nearly complete, and the plant is temporarily relying on an older server while a replacement is prepared. The letter has been turned over to the FBI, and the incident adds to mounting concern over cyber threats to U.S. water utilities from both ransomware actors and state-linked campaigns associated with Iran and China.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By the time the incident was publicly reported, recovery was nearly complete. The plant was temporarily operating on an older server while preparing a new replacement system.
The ransom letter recovered from the incident was turned over to the FBI as part of a potential investigation into the attack on the water treatment plant.
City officials said they found a ransom note or letter displayed on the affected server, but it did not include a dollar amount and there was no direct interaction with the attackers. The city did not pay a ransom.
A ransomware attack affected the Minot, North Dakota water treatment plant in March, compromising a server tied to the plant's SCADA environment. Operators disconnected the affected server and shifted to manual procedures and gauge readings for about 16 hours while keeping water service operational and safe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
More than 30 community water systems in Minnesota were hit by a coordinated cyberattack that caused limited operational disruptions but did not make drinking water unsafe, according to reporting cited in *Srsly Risky Biz*. The incidents came less than a week after US federal agencies refreshed a warning that Iranian state-affiliated actors may target US critical infrastructure, noting compromises and operational disruption across multiple sectors since March. While the Minnesota activity was not formally attributed, Tenable said the operational pattern was consistent with **CyberAv3ngers**, a threat actor linked to Iran’s Islamic Revolutionary Guard Corps. The attacks fit a broader pattern of low-level but disruptive operations against operational technology and embedded devices, where adversaries exploit weak remote access, exposed management services, compromised credentials, and insecure update mechanisms to interrupt physical processes. Research on destructive OT incidents has shown that even relatively simple techniques can disable or brick field devices, routers, modems, and monitoring equipment, increasing pressure on operators of water, energy, and other essential services to harden remote management, validate firmware and logic updates, and prepare recovery plans for device-level disruption.
Aug 1, 2026
A coordinated cyberattack disrupted water and wastewater utilities in more than 30 Minnesota communities, prompting a multiagency response from Minnesota Information Technology Services and federal partners including **CISA**, the **EPA**, and the **FBI**. A restricted **WaterISAC** `TLP:AMBER` notification said the Minnesota Fusion Center reported ongoing malicious cyber activity affecting Minnesota water utilities, indicating the incident was active enough to warrant limited-sector sharing. Local impacts included Braham’s water plant going offline and Plymouth isolating affected equipment connected to two water towers and several lift stations as responders worked on containment, investigation, remediation, and threat-intelligence sharing. Officials said water quality remained safe, and no public attribution has been announced, though the incident comes amid broader federal concern over attacks on internet-connected operational technology in under-resourced U.S. water systems.
Jul 31, 2026
Romania's national water management agency, Administrația Națională Apele Române (Romanian Waters), suffered a significant ransomware attack that compromised around 1,000 systems, including servers, workstations, and critical IT infrastructure. The attackers used Microsoft's BitLocker, a legitimate Windows encryption tool, to lock files and left ransom notes demanding negotiations within seven days. Despite the widespread IT disruption, operational technologies such as dams and flood defenses remained unaffected, and hydrotechnical operations continued with staff relying on alternative communication methods like telephone and radio due to email outages. Authorities have not attributed the attack to a known ransomware group and have advised against negotiating with the attackers. The Romanian National Cyber Security Directorate (DNSC) confirmed that the attack impacted ten of the country's eleven river basin management organizations, but emphasized that water infrastructure operations were not disrupted. The use of BitLocker as a "living off the land" technique highlights a trend where attackers leverage built-in system tools to evade detection and complicate incident response. The DNSC reiterated its policy of not engaging with cyber extortionists and urged IT teams to focus on system restoration rather than external communications. The agency continues to investigate the incident and work towards full remediation of affected systems.
Jun 29, 2026