On July 26-27, 2026, over 30 Minnesota community water systems experienced coordinated cyber intrusions targeting their OT systems, disrupting automated controls. The attacks affected remote assets connected via cellular modems, causing some utilities to activate contingency procedures and, in one case, temporarily shut down a water treatment plant. While the drinking water supply remained safe, the incidents highlight vulnerabilities in cellular communication links within industrial control systems. No confirmed attribution exists, though Iranian threat groups have been mentioned as potential suspects. The events underscore the need for comprehensive vulnerability assessments including secondary communication paths in critical infrastructure.

The attacks disrupted automated control functions at multiple municipal water and wastewater utilities, causing at least one water plant to go offline temporarily and prompting water use advisories. While water and wastewater services largely remained operational and drinking water safety was not compromised, the incidents demonstrated the potential for denial or loss of control over critical OT systems. The disruption of cellular-connected equipment reveals a significant attack vector that could affect similar infrastructure beyond Minnesota. No physical damage or safety incidents have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Meanwhile, affected utilities have activated contingency procedures and manual operations where necessary. It is recommended that organizations reassess their vulnerability studies to include cellular communication paths and other secondary links often overlooked in OT risk assessments. Enhanced monitoring and segmentation of cellular-connected devices should be considered to reduce attack surface. Follow updates from official investigations and apply any vendor or government-issued advisories promptly.