Written byOlivia Tempest

30 July 2026

Share

More than 30 community water systems in Minnesota were targeted by a coordinated cyberattack affecting operational technology on July 26 and 27, according to Minnesota IT Services (MNIT).

The state agency activated its cybersecurity incident response capabilities after becoming aware of the incident and is working with federal, state, local, Tribal and private-sector partners to investigate the attack, support affected communities and strengthen protections for critical infrastructure.

MNIT cybersecurity teams are assessing the impacts of the incident while sharing threat intelligence, providing technical guidance and supporting affected utilities with containment, investigation and recovery efforts. The response involves coordination with organisations including the Minnesota Department of Public Safety, the Bureau of Criminal Apprehension’s Minnesota Fusion Center, the Minnesota Department of Health, the Minnesota Pollution Control Agency, the Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Environmental Protection Agency (EPA), the Federal Bureau of Investigation (FBI) and local water utilities.

The investigation remains ongoing, with responders continuing to evaluate affected systems. The Minnesota Department of Health is working directly with impacted water systems to help ensure public health protection is maintained.

The investigation remains ongoing, with responders continuing to evaluate affected systems.

At this time, the department has not received any requests from Minnesota cities for residents to change their drinking water usage due to the cyberattack.

Several municipalities had previously disclosed cyber incidents affecting their systems, including Plymouth, South St. Paul, Maple Plain and Braham. The cities reported that impacts were limited or had been mitigated, and residents were able to continue normal water use.

John Israel, Assistant Commissioner at MNIT and Minnesota Chief Information Security Officer, said the incident highlighted the importance of coordinated cybersecurity efforts for critical infrastructure. “Cyberattacks against critical infrastructure require a coordinated, whole-of-government response,” Israel said. “MNIT is working side by side with our partners to share intelligence, support affected communities, and help utilities restore operations safely while strengthening defenses against future attacks.”

MNIT said its response activities include coordinating technical support among government partners, sharing threat intelligence and indicators of compromise, assisting with investigation and recovery efforts, monitoring for related malicious activity, and providing cybersecurity expertise to affected communities.

Rafael Narezzi, co-founder and CEO of Centrii told Smart Water Magazine that the incident highlights the growing importance of protecting operational technology systems in the water sector. He noted that coordinated attacks affecting multiple distributed facilities represent a different challenge from isolated cybersecurity incidents at large utilities, particularly for smaller operators with limited resources.

Narezzi also stressed the importance of proactive cybersecurity measures and operational resilience, including the ability of utilities to maintain essential services through manual procedures when automated systems are disrupted.

The agency added that Minnesota’s Whole-of-State Cybersecurity Program brings together federal, state, local, Tribal and critical infrastructure partners to prepare for, respond to and recover from cyber incidents.

Written byOlivia Tempest