Hackers are going after our water now — over 30 Minnesota utilities hit in coordinated cyberattack by apparent Iranian attackers

A cyberattack targeting operational technology has affected more than 30 community water systems in Minnesota, momentarily disrupting treatment plants and compelling several towns to operate manually. The attack, which targeted pumps, wells, water towers, and wastewater lift stations, was attributed to Iranian-affiliated hackers by a leaked WaterISAC memo, though no formal US attribution has been issued.

Four days prior to the attacks, the Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory warning that Iranian-affiliated actors were compromising internet-facing programmable logic controllers (PLCs) used in water, energy, and government sectors. However, this warning was largely disregarded, as many small communities lack the necessary cybersecurity resources.

The Minnesota attacks began on July 28 2026, with Braham, a town of approximately 1,700 people, experiencing the most severe consequences. The city's water treatment plant and well were taken offline, but crews managed to restore operations manually within a couple of hours. Other affected areas, such as Plymouth and Maple Plain, managed to contain the issue through contingency procedures.

Despite the limited impact, the symbolic nature of the attack, targeting a fundamental public service, suggests political motivations. The timing of the attacks coincides with the breakdown of the recent US-Iran ceasefire and recent US strikes near the Strait of Hormuz, which caused damage to a water facility, affecting over 20,000 people.

The successful restoration of operations in Minnesota highlights the resilience of utilities with knowledgeable personnel, even in the absence of robust digital defenses.