Over 30 individual Minnesota water and wastewater treatment facilities were simultaneously hit with a cyber-attack from an unknown source on July 26 and 27, 2026. The coordinated attack targeted the utilities’ operational technology systems and caused some affected communities to request that residents minimize water use due to limited stored water. Other communities experienced equipment malfunctions requiring them to implement contingency plans and switch to manual operations.
The Minnesota IT Services agency activated its incident response plan statewide in response to the attack. Although the attacker is unknown, there is speculation that it may be attributable to Iran-backed hackers in response to attacks on a southern Iranian water treatment plant.
Australia and the U.S. Cybersecurity & Infrastructure Security Agency (CISA) issued guidance on July 28, 2026, for critical infrastructure operators to isolate vital systems during cyber attacks “or periods of increased cyber threat.” CISA has been warning critical infrastructure operators about increased threats from Iranian-affiliated cyber actors repeatedly since the war in Iran commenced.
The fact that the threat actors coordinated this attack to affect multiple utilities across an entire state is rather frightening. Critical infrastructure operators should stay informed of the CISA issued guidance and take the warnings seriously.