Loading story…
A coordinated cyberattack disrupted water and wastewater utilities in more than 30 Minnesota communities, prompting a multiagency response from Minnesota Information Technology Services and federal partners including CISA, the EPA, and the FBI. A restricted WaterISAC TLP:AMBER notification said the Minnesota Fusion Center reported ongoing malicious cyber activity affecting Minnesota water utilities, indicating the incident was active enough to warrant limited-sector sharing.
Local impacts included Braham’s water plant going offline and Plymouth isolating affected equipment connected to two water towers and several lift stations as responders worked on containment, investigation, remediation, and threat-intelligence sharing. Officials said water quality remained safe, and no public attribution has been announced, though the incident comes amid broader federal concern over attacks on internet-connected operational technology in under-resourced U.S. water systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
An operational technology industry coalition called for a stronger U.S. federal response after suspected Iran-linked intrusions affected more than 30 Minnesota water utilities. The group urged CISA to issue a Binding Operational Directive for federal civilian OT systems and asked Congress to renew cybersecurity grant and information-sharing programs.
On 2026-07-30, the FBI and EPA issued Alert I-073026-PSA warning that malicious actors were targeting internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs in the water and wastewater sector. The agencies said utilities in at least seven U.S. states had reported incidents to the FBI since 2026-07-27, with some attacks degrading operations through password and IP changes, modified project files, pressure loss, and flooding.
On 2026-07-30, CISA urged water and wastewater operators to secure internet-exposed PLCs and other OT assets after coordinated attacks disrupted automated controls at more than 30 Minnesota community water systems. The agency said it is seeing increased PLC targeting in the water sector, including password changes and IP address alterations that can lock out operators or disconnect controllers, and recommended measures such as removing public exposure and maintaining clean backups.
By 2026-07-30 reporting, four cities had publicly acknowledged impact from the coordinated Minnesota water utility cyberattack: Braham, Plymouth, South St. Paul, and Maple Plain. South St. Paul and Maple Plain were newly identified affected communities beyond those previously named publicly.
On 2026-07-29, Tenable said the coordinated cyberattacks that disrupted more than 30 Minnesota community water systems appeared consistent with activity by the Iran-linked group CyberAv3ngers. Minnesota and federal officials had not formally attributed the incident at that time.
The Minnesota Fusion Center reported ongoing malicious cyber activity impacting Minnesota water utilities in a WaterISAC notification marked TLP:AMBER. The available reference metadata does not disclose technical details, attribution, or specific affected utilities.
Reporting published on 2026-07-31 said the coordinated cyberattacks against more than 30 Minnesota community water systems on July 26 and July 27 locked out operators, disrupted plants, and prompted boil-water notices, while water delivery continued normally. This adds a new publicly reported impact detail beyond earlier accounts that said water quality remained safe.
A coordinated cyberattack disrupted water and wastewater utilities in more than 30 Minnesota communities on Sunday and Monday. Reported impacts included Braham’s water plant going offline and Plymouth isolating affected equipment tied to two water towers and multiple lift stations, while officials said water quality remained safe.
On 2026-07-22, CISA updated Advisory AA26-097A to expand observed targeting beyond Rockwell Automation to Schneider Electric and Siemens PLCs. The update also added evidence of PLC project file exfiltration and manipulation of Add-On Instructions that could disable safety and alarm functions.
Minnesota Information Technology Services said it is assisting affected utilities with containment, investigation, remediation, and threat intelligence sharing. Federal partners including CISA, the EPA, and the FBI are also involved in the response.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
39 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcenextgov.com
Open sourcecyberscoop.com
Open sourcewaterisac.org
Open sourcecisa.gov
Open sourceplymouthmn.gov
Open sourceic3.gov
Open sourcencsc.gov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
More than 30 community water systems in Minnesota were hit by a coordinated cyberattack that caused limited operational disruptions but did not make drinking water unsafe, according to reporting cited in *Srsly Risky Biz*. The incidents came less than a week after US federal agencies refreshed a warning that Iranian state-affiliated actors may target US critical infrastructure, noting compromises and operational disruption across multiple sectors since March. While the Minnesota activity was not formally attributed, Tenable said the operational pattern was consistent with **CyberAv3ngers**, a threat actor linked to Iran’s Islamic Revolutionary Guard Corps. The attacks fit a broader pattern of low-level but disruptive operations against operational technology and embedded devices, where adversaries exploit weak remote access, exposed management services, compromised credentials, and insecure update mechanisms to interrupt physical processes. Research on destructive OT incidents has shown that even relatively simple techniques can disable or brick field devices, routers, modems, and monitoring equipment, increasing pressure on operators of water, energy, and other essential services to harden remote management, validate firmware and logic updates, and prepare recovery plans for device-level disruption.
Aug 1, 2026
Canada’s Centre for Cyber Security has issued a warning about the increasing threat posed by hacktivists and other malicious actors targeting industrial control systems (ICS) in critical sectors such as water, oil and gas, and agriculture. The agency highlighted recent real-world incidents where attackers gained access to control systems, including a case where hackers tampered with water pressure at a Canadian water utility, impacting customer service. The alert also referenced similar attacks in the United States, such as the Cyber Av3ngers’ intrusion into a Pennsylvania water authority’s ICS and the Oldsmar, Florida incident where a hacker attempted to alter chemical levels in the water supply. These events underscore the risks associated with internet-exposed ICS devices and the potential for operational disruption. In the United Kingdom, reports obtained from the Drinking Water Inspectorate (DWI) reveal that five cyberattacks have targeted Britain’s drinking water suppliers since early 2024. While none of these incidents directly compromised the safety of the water supply, they did affect the organizations responsible for its delivery. The DWI noted that current regulations only require formal reporting of cyber incidents that disrupt essential services, potentially leaving other significant threats unreported. British officials are considering changes to the legal framework to lower the threshold for mandatory disclosure of cyber incidents affecting critical infrastructure. Both Canadian and British authorities emphasize the growing cyber risk to water utilities and the need for improved resilience and reporting standards.
Jun 29, 2026
A ransomware attack compromised a server tied to the **Minot Water Treatment Plant** in North Dakota, affecting the plant’s **SCADA** environment and forcing operators to switch to manual procedures for about 16 hours. City officials said the plant and related water system facilities remained operational and the water supply stayed safe throughout the incident. The facility serves Minot and surrounding communities through the **Northwest Area Water Supply**, reaching roughly **80,000 people**. Officials said they unplugged the affected server after discovering the intrusion on March 14 and found only a ransom letter displayed on the screen, with no direct contact from the attackers and no specified payment demand. The city did not pay a ransom, recovery is nearly complete, and the plant is temporarily relying on an older server while a replacement is prepared. The letter has been turned over to the **FBI**, and the incident adds to mounting concern over cyber threats to U.S. water utilities from both ransomware actors and state-linked campaigns associated with **Iran** and **China**.
Jun 29, 2026