Minnesota water systems hit by coordinated cyberattack, officials say

More than 30 Minnesota community water systems were targeted in a coordinated cyberattack that hit operational technology on July 26 and July 27, according to Minnesota IT Services. The attack put small public utilities in focus because many depend on modest water plants, wells and treatment facilities run by lean municipal teams with limited cybersecurity staff and little room for specialized defenses.

Minnesota IT Services activated the state’s cybersecurity response after the breach was disclosed. Officials said drinking water remained safe, no drinking water advisories were issued and there was no impact on water quality. They also said no ransom had been demanded, even as the FBI and the Minnesota Bureau of Criminal Apprehension joined the investigation into the incidents.

The disruption was not uniform across the state. CBS Minnesota reported that the Braham water plant was briefly offline for an unknown reason Monday morning and was restored in under two hours. Other local reports said several cities had already flagged cybersecurity incidents at their water utilities, while the statewide response underscored how quickly a technical intrusion can spread concern well beyond the sites directly affected.

The state did not disclose who was behind the attack. WCCO described it as one of the largest cyberattacks in Minnesota history, a label that reflected scale as much as consequence: public water service continued, but the event exposed how vulnerable local utilities can be when attackers strike the digital systems that control pumps, monitoring and treatment equipment. The episode fits a pattern federal officials have warned about for years. In October 2021, U.S. authorities disclosed ransomware attacks against water facilities, a reminder that drinking-water operations remain a persistent target even when contamination does not occur.