Minnesota Water Cyberattack Hits More Than 30 Systems
The Hacker News reported that Minnesota opened a statewide response after more than 30 community water systems were affected, with attribution and the access method still unconfirmed.
Minnesota IT Services said more than 30 community water systems were hit over two days, forcing some utilities to switch controls to manual operation or ask residents to reduce consumption.
The Hacker News reported the July 26 and 27 incidents.
Braham’s treatment plant went offline, Plymouth kept services running manually and Maple Plain declared a local emergency after automated controls were affected.
Minnesota Response Covers Water And Wastewater Controls
MNIT told The Hacker News that more than 30 water systems across the state were impacted, while the effect differed by utility.
The agency was still determining how many systems experienced operational disruption.
The statewide response covers containment, investigation, recovery and threat-intelligence sharing.
MNIT is working with state agencies, CISA, EPA, the FBI and the utilities involved.
John Israel, who serves as MNIT assistant commissioner and the state's chief information security officer, called attacks on critical infrastructure a whole-of-government issue.
The agency credited the response with containing the incident and limiting more serious effects on essential services.
As of July 28, MNIT said it was not aware of active requests for residents to change drinking-water use.
That detail kept the statewide notice separate from the local service interruptions described by Braham, Plymouth and Maple Plain.
Similar Timing Does Not Set Attribution
The operational pattern created an attribution problem rather than a finished culprit list.
MNIT identified common characteristics across incidents, including timing, access patterns and the kind of infrastructure targeted, but investigators had not determined whether one actor was responsible for every case.
A federal warning four days before the Minnesota incidents covered Iranian-affiliated activity against internet-facing programmable logic controllers from Rockwell Automation, Schneider Electric, Siemens and potentially other manufacturers.
The same alert involved changes to project files and manipulation of information displayed through industrial-control interfaces.
No Minnesota or federal agency has publicly linked the water-system intrusions to that earlier warning.
Tenable researcher Scott Caveza told The Hacker News that the tactics were consistent with tradecraft associated with CyberAv3ngers and other groups linked to Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command, but the Minnesota case had not received official attribution.
Operators Still Lack Product And Access Details
The incident leaves utilities with an incomplete technical record.
MNIT has not named the attacker, affected products, exploited vulnerability, access method or any data-theft finding, and the agency is withholding technical details while the investigation continues.
The public-service consequence is narrower but immediate.
Braham's water-treatment interruption, Plymouth's manual operations and Maple Plain's emergency declaration show that automated-control incidents can move quickly from cybersecurity response into city operations, even when drinking-water restrictions are not in force statewide.
CISA's broader advisory contains sector-level guidance, but it does not identify a Minnesota-specific controller family or exploited flaw.
The investigation remains active as responders continue to assess affected systems.
