A coordinated cyberattack hit more than 30 Minnesota municipal water systems on July 26–27, 2026, forcing manual operations at multiple plants and triggering a multi-agency federal-state response. The incident did not compromise drinking water safety, but it exposed a structural vulnerability in the sector: cellular modems installed by third-party integrators, often invisible to security audits, that connect industrial controllers directly to the internet.
- More than 30 Minnesota water systems hit in two days of coordinated attacks; four cities publicly disclosed operational disruptions
- Attackers changed PLC IP addresses and passwords, locking out operators, and in at least one case altered project files with ladder logic discrepancies
- Minnesota IT Services confirmed commonalities in timing, access methods, and targeted infrastructure, without formal attribution
- The campaign fits a pattern of internet-exposed PLC attacks flagged by CISA in advisory AA26-097A updated July 22, four days before the assault
July 26: How Automation Collapsed
The attack targeted Rockwell Automation MicroLogix 1100 and 1400 Programmable Logic Controllers (PLCs), according to the joint FBI/EPA advisory I-073026-PSA. Intruders remotely accessed internet-connected devices, modified credentials and IP addresses to exclude legitimate operators, and in at least one organization altered project files with discrepancies in ladder logic — the language governing physical plant operations.
In Braham, a town of roughly 1,700 residents, the attack caused a complete shutdown of the water treatment plant. The city's statement reports verbatim that attackers "shut off the operational controls, which shut off the well and the water treatment plant." In Plymouth, a city of about 80,000, the issue was limited to equipment connected via cellular to two water towers and multiple wastewater lift stations; staff disconnected the hardware and ran plants manually. Maple Plain declared a local emergency; South St. Paul reported compromised automated controls with services maintained.
No boil-water advisories were issued in Minnesota, and according to official sources, drinking water quality was not compromised in confirmed cases. Operational impact is documented: loss of pressure and flooding reported in the FBI advisory, plus the need for manual management at multiple sites.
"At this point, we can confirm that over 30 water systems across the state were impacted. The nature and extent of the impact varied by system, and the investigation is still determining how many experienced operational disruptions" — MNIT spokesperson to The Hacker News
The Role of Cellular Modems: The Assault That Bypasses Firewalls
The most significant — and least visible — technical element concerns cellular connections. In Plymouth, the municipal statement specified the impact involved "equipment connected via cellular communications within the system." These modems, frequently installed by third-party integrators for remote monitoring and maintenance, often evade security inventories and vulnerability assessments because they do not traverse corporate IT networks.
The result is a surface-level attack that completely bypasses the presumed segmentation between IT and OT. A 4G/5G modem connected directly to a PLC exposes the industrial controller to the internet without standard perimeter defenses detecting its presence. The editorial angle suggested in the dossier — the "cellular blind spot" — finds confirmation here: post-incident assessments risk repeating the same error if they do not explicitly map these parallel connections.
The documents do not reveal the initial access vector in the other affected cities. Uncertainty remains on full technical details: MNIT has kept specifics confidential during the ongoing investigation.
The Broader Campaign and the Iranian Shadow
The Minnesota attack fits into a wider series. The joint FBI/EPA advisory of July 30 reported incidents in at least seven states since July 27, with "degraded water operations." CISA flagged boil-water advisories and sustained manual operations in other jurisdictions during the same period. SecurityWeek and other outlets subsequently reported at least 12 affected states and nine municipal systems in Michigan with consistent activity.
CISA advisory AA26-097A, updated July 22, 2026, documents a campaign by Iran-affiliated actors targeting internet-exposed PLCs, specifically referencing Rockwell, Schneider, and Siemens. The update includes guidance on Add-On Instruction (AOI) manipulation and indicators of compromise. Tenable Research Special Operations noted that tactics observed in Minnesota remain "consistent with the tradecraft attributed to CyberAv3ngers and other IRGC-CEC affiliated groups," while stressing this is not official attribution.
The dossier does not establish whether the Minnesota attacks are directly linked to the Iranian campaign documented by CISA or represent a separate actor employing similar TTPs. MNIT explicitly stated investigators "are not yet able to determine if a single actor is responsible."
The reference to CVE-2021-22681, with a CVSS 9.8 score per the National Vulnerability Database, concerns an authentication bypass in Rockwell Logix controllers and was added to the CISA KEV catalog in March 2026. The dossier does not confirm, however, that this vulnerability was exploited in the Minnesota attacks specifically.
Why It Matters
The U.S. water sector has characteristics that amplify exposure: geographically distributed infrastructure, limited security budgets, reliance on third-party integrators for remote connectivity. The Minnesota case demonstrates these factors are not theoretical: more than 30 systems were compromised in 48 hours using techniques requiring no custom malware, only remote access to misconfigured devices and weak credentials.
Ladder logic manipulation, documented in the FBI advisory with "discrepancies at multiple sites," elevates the risk from simple denial of control to potential physical sabotage. Modifying project files allows alteration of interlocked safety parameters: disabling a pressure or level interlock can translate into material damage without operator visibility.
The institutional response reflects perceived severity. MNIT, CISA, EPA, and FBI coordinated the investigation. CISA issued a sector alert on July 30 with specific guidance on Rockwell MicroLogix 1400 PLCs. Minnesota IT Services designated the incident a "coordinated cyberattack," terminology implying planning and common purpose rather than isolated opportunistic exploits.
For critical infrastructure operators, the dossier does not specify defined remedial measures at the individual entity level. It remains undocumented whether data was exfiltrated from Minnesota systems, what technical countermeasures were distributed post-incident, and whether affected cities removed or merely temporarily isolated compromised hardware.
The Integrator Supply Chain as the Weak Link
A structural reading emerges from confirmed details: security responsibility disperses along the service supply chain. The water utility manages the plant but often does not control cellular modem installation or hold administrative credentials. The integrator configures remote access for operational convenience, with default or unrotated passwords. The result is an attack surface invisible to traditional security tools, which do not map out-of-band connections.
The Minnesota episode is not a case of advanced technical sophistication, but of information asymmetry: the attacker knew where to look, while the defender did not know that connection existed. Replication of this pattern across more than 30 sites in a single weekend suggests systematic prior reconnaissance, not casual exploit.
The absence of formal attribution does not lessen operational urgency. The pattern is sufficiently defined to justify immediate audits of cellular connections at all plants with exposed Rockwell PLCs, regardless of geography. The question for operators is not who attacked, but why the same vulnerable configuration repeats at sector scale.
Frequently Asked Questions
Was Minnesota drinking water contaminated?
No. According to official sources, no boil-water advisories were issued in Minnesota and water quality was not compromised in confirmed cases. Impacts concern automation and operational controls.
Are the attacks definitively attributed to Iran?
No. MNIT explicitly stated it cannot determine if a single actor is responsible. Tenable described tactics as "consistent" with IRGC-CEC affiliated groups, but this is pattern analysis, not official attribution.
What vulnerability was exploited?
Not confirmed. CVE-2021-22681, an authentication bypass with CVSS 9.8, is documented for related campaigns but not specifically for the Minnesota attacks. Full technical details are considered confidential by MNIT.
Sources
- https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know
- https://www.securityweek.com/dozens-of-minnesota-water-utilities-targeted-in-coordinated-ot-attacks/
- https://thehackernews.com/2026/07/coordinated-cyberattack-targets-30.html
- https://www.nbcnews.com/tech/security/hackers-targeted-municipal-water-systems-7-states-week-fbi-says-rcna590210
- https://www.rescana.com/post/coordinated-cyberattacks-on-us-municipal-water-systems-plc-exploitation-hits-minnesota-and-6-other-states-in-july-2026
- https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a
- https://podcast.securityweek.com/
Information verified against cited sources and current as of publication.