More Than 30 Minnesota Water Systems Hit in a Coordinated OT Attack (July 26-27, 2026)

More Than 30 Minnesota Water Systems Were Hit at Once. The Water Stayed Safe. The Controls Did Not.

Over a single weekend, attackers went after the operational technology at more than 30 Minnesota community water systems. One city's treatment plant dropped offline. Another lost telemetry to its water towers and sewer lift stations. Operators kept the water safe by running their plants by hand. State officials say the goal looked like disruption, not money.

Attack window July 26-27, 2026 · 30-plus systems targeted · 4 cities publicly confirmed impact · No attribution released · MNIT · MDH · FBI

What Actually Broke, City by City

Four Minnesota cities have publicly described impact. Every one of them kept drinking water safe.

Braham

The water plant went offline Monday morning after what the city described as a malicious cyberattack on its computerized operating systems by unknown actors. Operating controls for the well and the treatment plant were disabled. No physical damage and no water-quality problem. Braham is a town of roughly 1,800 people in Isanti County.

Plymouth

Lost cellular communications to two water towers and multiple wastewater lift stations starting late Sunday. Staff ran the system manually. The city stated water levels and quality were unaffected, the water was safe, and residents did not need to change how much they used.

South St. Paul

A cybersecurity incident affected the water utility's technology and its automated controls. Public Works staff maintained normal water and wastewater operations by hand.

Maple Plain

Certain automated control functions were affected. The city maintained normal operations and confirmed the water remained safe to drink.

No boil-water advisory was issued in any affected community. The Minnesota Department of Health was involved in the response, and the state noted that any public-health advisory would come from local officials or state health authorities directly.

Why This One Should Change How You Think About Your Plant

Read the four city summaries again and notice what they have in common. In every case, the water was fine and the controls were not. Operators saved these systems by dropping to manual operation. That is real operational competence, and it is also the entire problem: the automation layer failed and the humans absorbed it.

Three things make this incident more useful than the examples most vendors still quote at you.

It is days old, not years old. Aliquippa was November 2023. Muleshoe was 2024. When a water board hears a 2023 example, the honest reaction is "that was a while ago, and nothing happened to us." July 2026 does not allow that answer.

The motive was disruption, which removes the usual excuse. The most common objection from a small utility is "we are too small to be worth a ransom." That reasoning only protects you from criminals who want money. It offers nothing against an actor whose goal is to make a town's water plant stop working, and by the state's own read, that is what this was.

These were small systems. Braham serves roughly 1,800 people. If your defense is that you are too obscure to target, Braham was more obscure, and it was hit as part of a coordinated set of 30-plus.

One more thing worth saying plainly, because the internet got this wrong within a day: no one has attributed this attack. The pattern of going after internet-reachable control systems at small water utilities is the same pattern federal advisory AA26-097A describes, and that advisory does name Iranian-affiliated actors. Those are two separate facts. Treating the resemblance as an identification is exactly the kind of shortcut that stops people believing a security vendor.

What To Do This Week

If you run a water or wastewater system, these are the questions this incident should make you ask.

Find out what of yours answers the internet. Not what should, what does. Towers, lift stations, and remote sites are the usual surprises because they were connected by a vendor for convenience years ago.
Ask whether you would have noticed. Braham found out when the plant stopped. If your only alarm for a control-system compromise is the process failing, you do not have detection, you have consequences.
Test running manually, on purpose. Every city that came through this did it by hand. Confirm your staff can, confirm they know which valves and pumps, and confirm it does not depend on one person who might be on vacation.
Inventory the cellular and radio links. Plymouth's failure was communications to towers and lift stations, not the plant itself. Those links are frequently outside whatever anyone thinks of as "the network."
Separate the control network from the business network, and check that the separation is real rather than a diagram. A flat network means one entry point reaches the pumps.
Write down who you call. MNIT, the state health department, and the FBI were all in this response. Know your equivalents before you need them at 6am.

How RedEye Helps You Answer This

The assessment is built to answer the two questions this incident raises: what is exposed, and would you see it.

Discovery

We map what of yours is reachable from the internet, including the remote sites and vendor links that never made it onto a drawing.

Monitoring

We put visibility on the control network so a change to a setpoint or a controller looks different from a technician doing their job.

Threat Hunt

We look for the indicators from current federal advisories, including historical activity that predates the engagement.

Report

A prioritized roadmap aligned to EPA priority controls and AWWA guidance, in language your board and your operators can both use.

Would You Have Found Out Before the Plant Stopped?

Free scoping call. We check what of yours is exposed, hunt for current advisory indicators, and show you what an assessment covers. Federal grants may cover the cost.

Schedule Free Scoping Call