Suzanne Kantra/Techlicious generated by ChatGPT
A coordinated cyberattack hit more than 30 community water and wastewater systems across Minnesota on July 26 and 27, according to Minnesota IT Services, the state agency that handles cybersecurity for local government systems. The attack targeted operational technology, the specialized computer systems that run physical equipment like pumps, valves, and treatment processes, rather than the office networks most people picture when they hear "cyberattack."
At least four cities have described specific effects. Braham's water treatment plant went offline, and the city asked residents to cut back on water use until treatment resumed. Plymouth reported cellular communication failures at two water towers and several wastewater lift stations but kept running its systems manually. South St. Paul and Maple Plain both said automated utility controls were affected; Maple Plain declared a local state of emergency to support its response.
Minnesota IT Services said it isn't aware of any city asking residents to change how they use tap water over safety concerns, and that water quality has stayed safe throughout. Agency spokesperson Emily Zimmer told Reuters that "the timing, methods of access, and targeted infrastructure share characteristics with other coordinated cyber incidents our federal partners have observed involving critical infrastructure," though she said formal attribution isn't ready yet.
The timing lines up closely with a July 22 update to a federal advisory that expanded a warning about Iran-linked hackers targeting the industrial computers that operate machinery like pumps and valves. That update added Schneider Electric and Siemens equipment to a warning that previously covered only Rockwell Automation devices, and for the first time described attackers copying and modifying the underlying project files that control how the equipment behaves.
While there has been no evidence released tying Iran to this attack, it wouldn't be the first time Iran-linked hackers have targeted U.S. water utilities. Past attacks have exploited the same class of internet-connected industrial controllers, many of which are installed with weak or default passwords and left reachable from the open internet.
Read next: AT&T Fiber beats Verizon, Xfinity and Cox for best internet provider
