Minnesota reports coordinated cyberattack on more than 30 water systems

Minnesota IT Services disclosed a coordinated cyberattack that affected more than 30 local water systems across the state, putting small-town water infrastructure at the center of a national security warning sign. The attacks hit on July 26 and 27, and the state said it immediately activated its cybersecurity incident response capabilities and began working with federal, state, local, Tribal and private-sector partners.

The breach underscores why smaller utilities are often attractive targets. Many community water systems do not have the cybersecurity budgets, staffing depth or monitoring tools of large metropolitan providers, yet they still run the pumps, controls and treatment processes that keep water flowing and safe. When attackers probe those networks, the risk is not limited to data theft. Public health, sanitation, fire protection and day-to-day service can all be exposed if operational technology is disrupted.

Early local reporting identified at least three facilities in Plymouth, South St. Paul and Braham as targets. The Braham water plant experienced a brief outage but was back in operation, and the cities said residents could continue normal water use and that the water was safe to drink. ABC News also reported there were no requests for residents to change their drinking-water habits, a sign that officials were working to contain the incident without imposing emergency restrictions on customers.

The Minnesota disclosure fits a broader pattern of concern that has grown around water-sector cybersecurity. On March 20, 2024, U.S. officials warned that hackers were carrying out disruptive attacks on water systems, and federal agencies have continued to press utilities to harden their defenses. In Minnesota, the state Department of Health maintains guidance titled Assessing Security of Public Water Systems, reflecting the long-standing expectation that drinking-water operators treat cybersecurity as part of basic system protection.

The attack also lands in a policy environment shaped by Executive Order 22-20, signed by Gov. Tim Walz on Aug. 30, 2022, which directed state entities overseeing critical infrastructure to focus resources on protection. Minnesota’s latest incident gives that order new urgency, especially for small and midsize systems that often operate with limited technical staff and aging software. Even where service is restored quickly, the episode shows how a coordinated strike on community utilities can ripple beyond one town and force closer federal oversight of essential services.