On July 26 and 27, 2026, hackers launched a coordinated cyberattack against OT systems at over 30 Minnesota community water utilities, resulting in temporary outages and operational disruptions. The City of Braham water plant was taken offline due to a malicious cyberattack but was restored within hours. Other communities reported equipment malfunctions and switched to manual or contingency operations. MNIT activated its cybersecurity incident response capabilities and is working with multiple partners to investigate and strengthen infrastructure security. The attacker(s) remain unidentified. CISA and allied agencies have issued guidance on isolating vital OT systems to mitigate impact. This incident aligns with broader trends of critical infrastructure targeting, including previous Iranian state-sponsored activity against PLC devices in water and energy sectors.

The attack caused temporary outages and equipment malfunctions at multiple water utilities, disrupting automated water treatment and filtration processes. Some utilities switched to manual operations or contingency plans to maintain service. No confirmed requests for changes in water usage were made, and services were restored promptly in affected locations. The incident highlights vulnerabilities in OT systems controlling critical infrastructure and the potential for disruption of essential public services.

No official patch or fix is indicated for this incident as it involves targeted attacks on OT systems rather than a specific software vulnerability. MNIT and partners are actively investigating and assisting affected utilities with containment and remediation. CISA recommends isolating critical OT systems to ensure continuity of essential services during cyberattacks. Utilities should follow guidance from MNIT and federal agencies on response efforts and best practices for OT security. Monitoring and threat intelligence sharing are ongoing to prevent further impact.