OVER 30 water utilities in Minnesota were hit by a coordinated cyberattack on 29 July 2026, forcing the Braham treatment plant offline for a short period. The outage triggered alerts across state monitoring systems, though no public health risk was identified.
No CVE has been assigned to the incident, but reports indicate the Braham plant was offline for about two hours before operators restored service using manual controls. Other utilities avoided disruption by switching to backup systems, and investigators have found no evidence that drinking water quality was affected.
Minnesota IT Services triggered its cybersecurity response immediately, working with federal partners and local agencies; the attack remains unattributed but occurred shortly after alerts about Iranian‑affiliated groups probing similar infrastructure. State officials said the response included forensic collection of logs and coordination with the Cybersecurity and Infrastructure Security Agency.
The episode shows how operational technology environments in the water sector can be knocked offline by relatively brief intrusions, raising concerns about the resilience of essential services against persistent threats. Officials warned that similar tactics could be used against other municipal services if basic network hygiene is neglected.
Utilities should verify that incident response playbooks include clear steps for isolating affected OT networks, confirm that backup power and manual override functions are tested regularly, and monitor remote access points for unexpected credentials. Regular tabletop exercises that simulate loss of HMI access can help crews regain control faster when automated functions are unavailable.
Applying multifactor authentication to any remote administration interfaces, segmenting corporate and control‑system networks, and sharing observed indicators with the Water ISAC can help reduce the chance of a repeat incident. By treating remote access as a privileged function and reviewing third‑party vendor connections, utilities can shrink the attack surface without costly overhauls.