Cyberattack Disrupts Water Utilities in More Than 30 Minnesota Communities
Summary
Minnesota officials say a cyberattack disrupted water and wastewater utilities in more than 30 communities. Braham’s plant went offline and Plymouth isolated affected equipment; water quality was unaffected, and the attacker remains unidentified.
Key points
- Minnesota’s technology agency said a coordinated cyberattack disrupted water and wastewater utilities in more than 30 communities on Sunday and Monday; its origin has not been determined.
- Braham’s water plant went offline and returned later Monday; officials asked residents to limit water use while the tower supply was limited.
- Plymouth disconnected affected equipment connected via cellular communications at two water towers and multiple lift stations; the city said water quality was unaffected.
- State and federal agencies, including CISA, the EPA and FBI, are assisting utilities with containment, investigation and remediation.
- Officials have not attributed the Minnesota attacks, and it is unclear whether they involved programmable logic controllers highlighted in a recent CISA advisory.
- The article cites longstanding preparedness concerns: the EPA warned in 2024 that more than 70% of water systems failed to meet a requirement for risk assessments and emergency response plans.
Article Details
- Victim Organization
- Water and wastewater utilities in more than 30 Minnesota communities, including the City of Braham and Plymouth
- Incident Type
- Coordinated cyberattack disrupting water and wastewater utility systems; origin undetermined and attribution not established
- Operational Impact
- Water treatment plant and utility equipment disruptions were reported in more than 30 communities. Braham's water plant went offline and later returned online. Plymouth disconnected affected equipment at two water towers and multiple lift stations; the affected equipment was connected via cellular communications. Officials said water quality was unaffected and water remained safe.
- Claim Status
- confirmed
People
John IsraelMinnesota's chief information security officer, quoted describing the state's whole-of-government response to the attack.Joshua CormanExecutive in residence at the Institute for Security and Technology and head of its UnDisruptable27 initiative; commented on risks and preparedness for water-utility cyberattacks.TJ SayersSenior director of threat intelligence at the Center for Internet Security; said the Minnesota attacks had not been attributed and that involvement of the PLCs mentioned in the advisory was unclear.
Threat Actors
CyberAv3ngersNamed in a federal advisory as an example of an Iranian hacking group attempting to target internet-connected operational technology devices. The article does not attribute the Minnesota attacks to this group.HanzalaClaimed to have breached water utility systems in several California cities and said it had refrained from disrupting their water supplies. The article does not connect the group to the Minnesota attacks.