Coordinated Cyberattack Disrupts Water Utilities in Over 30 Minnesota Communities
A coordinated cyberattack has disrupted water and wastewater utilities in more than 30 Minnesota communities, prompting a multi-agency response and raising concerns about critical infrastructure security.
A coordinated cyberattack struck water and wastewater utilities across more than 30 Minnesota communities on Sunday and Monday, state officials announced Tuesday. The incident disrupted operations, forcing some municipalities to issue water conservation advisories and prompting a swift, multi-agency response.
In Braham, a small city of 1,700 residents, officials reported on Monday morning that its water plant was offline due to a "malicious cyber-attack of computerized operating systems by unknown actors." Residents were urged to minimize water usage as the city's water tower held only a limited supply. By later that day, the plant was back online, but the incident highlighted the vulnerability of essential services.
Plymouth, a Minneapolis suburb with approximately 80,000 residents, also experienced disruptions. The city's IT division disconnected affected equipment from the network to contain the attack and prevent further spread. The disruption was limited to equipment connected via cellular communications at two water towers and multiple lift stations. City officials assured the public that water quality remained unaffected and safe.
Minnesota's Information Technology Services bureau is coordinating the response, providing threat intelligence, guidance, and assistance to affected utilities for containment, investigation, and remediation. The agency is collaborating with state public safety and health departments, a state fusion center, and federal partners including the Cybersecurity and Infrastructure Security Agency (CISA), the Environmental Protection Agency (EPA), and the FBI. John Israel, Minnesota's chief information security officer, stated that the "whole-of-government response" was effective in preventing more serious impacts.
While no specific threat actor has been officially named, the timing and nature of the attack have drawn attention to recent advisories from CISA and other federal agencies warning of Iranian hacking groups, such as CyberAv3ngers, targeting internet-connected operational technology (OT) devices. These groups have been observed attempting to compromise programmable logic controllers (PLCs) used in industrial control systems.
The incident also follows heightened geopolitical tensions, including U.S. strikes on an Iranian water facility and subsequent claims by the hacker group Hanzala of breaching water utility systems in several California cities. These events underscore a growing trend where nation-state or state-sponsored actors may prioritize disruption and destruction over data theft or financial gain.
Experts note that U.S. water utilities, many of which are small and resource-constrained, represent a significant target. A large percentage of these systems struggle to meet regulatory requirements for risk assessments and emergency response plans. The vulnerability of these systems is exacerbated by outdated infrastructure and a lack of dedicated cybersecurity resources, making them prime targets for sophisticated attacks.
The full scope of the Minnesota attack and its long-term implications are still under investigation. However, the incident serves as a stark reminder of the critical need for enhanced cybersecurity measures and preparedness across the nation's water infrastructure, especially as the threat landscape continues to evolve with new attack vectors and motivations.