Multiple Minnesota communities are investigating what appears to be a coordinated cyberattack that temporarily disrupted automated control systems at several municipal water and wastewater facilities, prompting utilities to switch to manual operations while maintaining safe drinking water service.

The City of Braham reported that its water treatment plant was taken offline for nearly two hours on July 13 after what officials described as a "malicious cyber-attack" targeting the facility's computerized operating systems. The attack shut down the plant's operating controls, forcing the well and treatment plant offline before public works staff restored service.

City officials said the incident caused no physical damage to the facility and did not affect drinking water quality or safety. Braham is now reviewing its system vulnerability assessment to identify and address any cybersecurity weaknesses exposed during the incident.

According to Braham officials, at least four other Minnesota communities experienced similar attacks. Among them, South St. Paul reported a cybersecurity incident affecting technology used for portions of its water utility, while Plymouth said a suspected cyberattack disrupted communications with two water towers and several lift stations. Maple Plain also identified an incident affecting automated water utility control functions.

In each case, utility staff maintained water and wastewater operations by transitioning to manual control procedures, and officials emphasized that drinking water remained safe for customers.

Minnesota IT Services is assisting affected communities by providing cybersecurity support, assessing potential impacts and sharing threat intelligence as investigators work to determine who was responsible for the attacks.