Among the affected utilities, the city of Braham reported that attackers temporarily disabled computerized operating controls, shutting down its well and water treatment plant until operators restored service. Other communities, including Plymouth, South St. Paul and Maple Plain, reported disruptions to automated controls or communications but maintained water and wastewater operations through manual procedures. Officials in each community said drinking water remained safe and no contamination occurred.
The incidents have since expanded beyond Minnesota. Michigan officials recently disclosed that nine water systems in the state also experienced cyberattacks, although operators maintained safe service and no public health impacts were reported. The FBI, the U.S. Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency (CISA) are investigating the incidents alongside state agencies.
Operational technology remains a target
The attacks primarily targeted operational technology (OT) systems, including remote monitoring and programmable logic controllers (PLCs) used to manage pumps, wells, lift stations and water towers, rather than enterprise information technology systems. Federal officials have warned that internet-connected industrial control equipment continues to present an attractive target for nation-state actors and cybercriminals, particularly at smaller utilities with limited cybersecurity resources.
While investigators have not publicly attributed the attacks, federal officials are examining whether they are connected to previously identified Iranian-affiliated cyber activity targeting critical infrastructure. Authorities caution that the investigation remains ongoing and no official attribution has been announced.
Manual operations limit service disruptions
Although the cyberattacks disrupted portions of automated control systems, most affected utilities were able to continue operations by switching to manual control procedures. The incidents underscore the importance of maintaining operational redundancy and emergency response plans alongside investments in cybersecurity.
Federal agencies have advised water utilities to review remote access practices, disconnect unnecessary internet-exposed control systems, implement multifactor authentication and ensure operators can safely transition facilities to manual operation if automated systems are compromised.
The recent attacks are the latest reminder that cybersecurity has become a core component of utility resilience. As drinking water and wastewater systems continue adopting digital monitoring, automation and remote operations, utilities face growing pressure to strengthen cyber defenses while ensuring reliable service and protecting public health.
