Iranian-Linked Cyberattack Disrupts 30+ Minnesota Water Systems A coordinated cyberattack targeted operational technology (OT) across more than 30 community water systems in Minnesota, disrupting pumps, wells, water towers, and wastewater lift stations. The incident, disclosed by Minnesota IT Services on July 28, 2026, forced several towns into manual operations but did not prompt any advisories for residents to alter water usage. A leaked WaterISAC memo, marked TLP: AMBER, attributed the intrusions to Iranian-affiliated hackers, though no U.S. agency has formally confirmed the attribution. The memo, corroborated by The New York Times and The Washington Post, cited intelligence from federal officials and state fusion centers. The attack exploited internet-facing programmable logic controllers (PLCs) from manufacturers like Rockwell Automation, Schneider Electric, and Siemens echoing a CISA advisory (AA26-097A) issued four days prior. The warning, which went largely unheeded, highlighted ongoing threats to U.S. water, energy, and government sectors, including confirmed disruptions and financial losses. Key impacts included: - Braham (pop. 1,700): Attackers disabled controls at the water treatment plant and well, forcing manual restoration within hours. - Plymouth (pop. 80,000): Compromised cellular-linked equipment at water towers and lift stations was isolated to prevent further damage. - Maple Plain and South St. Paul: Reported partial automation failures, though contingency plans maintained operations. CISA later warned that attackers were changing PLC passwords to lock out operators, reiterating long-standing guidance to remove PLCs from public internet access and secure remote connections via VPNs. The incident follows a November 2023 attack on Pennsylvania’s Municipal Water Authority of Aliquippa, where Iranian-linked actors defaced a Unitronics controller with an anti-Israel message exploiting default passwords. Despite repeated warnings, many small water systems lack dedicated cybersecurity resources. The timing coincides with escalating tensions between the U.S. and Iran, including recent U.S. strikes near the Strait of Hormuz that disrupted water supplies for over 20,000 people. While the Minnesota disruptions were brief, the attack underscores persistent vulnerabilities in critical infrastructure.