More than 30 Minnesota community water systems were hit in a coordinated cyberattack on July 26–27, targeting operational technology (OT) systems across cities including Plymouth, Braham, South St. Paul, and Maple Plain. Automated control functions were disrupted, and Braham briefly took its water plant offline after attackers shut down its well and operating controls.
State and federal agencies are investigating, though no group has been officially blamed. Iran-linked threat actors remain suspects given recent US warnings about attacks on industrial control systems.
Plymouth said its problems were limited to equipment connected via cellular communications — and that lines up with a known blind spot. Denis Calderone, CTO of Suzu Labs, notes that water towers, lift stations and pump stations often reach SCADA systems over cellular modems, and those secondary links are "frequently overlooked during risk analysis."
Drinking water remains safe across all affected cities. But BreachLock CEO Seemant Sehgal's warning applies well beyond Minnesota: whatever common weakness the attackers found here almost certainly exists in water infrastructure elsewhere.
Updated 11 Aug 2026: The FBI has since confirmed the campaign targeted water systems in at least seven states, including Michigan and Georgia.
Source: SecurityWeek
