Minnesota community water systems (30+) and other US utilities: coordinated OT attacks

What happened

• Minnesota IT Services (MNIT) said “more than 30 water systems throughout the state were impacted” on 26 and 27 Jul 2026. Braham’s water plant went offline (under two hours per KSTP), Plymouth lost cellular communications to two water towers and several lift stations and ran manually, South St. Paul and Maple Plain lost automated controls; Maple Plain declared a local emergency. Cities said drinking water stayed safe. In New Jersey, NJOHSP confirmed two municipal water systems lost automated monitoring and control and went to manual operation (5 Aug).
• Root cause: MNIT said the incidents shared timing, access methods and target type but gave no technical detail. An FBI/EPA warning of 30 Jul (reported by THN and NJBIZ) said actors accessed internet-facing Rockwell Automation / Allen-Bradley MicroLogix 1100 and 1400 PLCs in at least seven states, changed device IP addresses and passwords, and caused loss of monitoring and control, with some loss of pressure and flooding.
• Attacker: not officially attributed. The NYT reported a preliminary US assessment pointing to Iran; President Trump publicly said Iran was not behind it. Tenable says the pattern fits the CyberAv3ngers (IRGC-linked) ecosystem.
• Response: MNIT, FBI, CISA and state health departments investigating; utilities moved to manual operation and hardened remote access.

Sources

• https://thehackernews.com/2026/07/coordinated-cyberattack-targets-30.html
• https://njbiz.com/cyberattack-nj-municipal-water-systems/
• https://en.wikipedia.org/wiki/2026_Minnesota_water_system_cyberattack

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.