On July 26 and 27, 2026, a coordinated cyberattack disrupted operational technology at more than 30 community water systems across Minnesota. Minnesota IT Services (MNIT) activated a statewide incident response, working alongside CISA, the EPA, and the FBI to contain the intrusion, support affected utilities, and investigate. Braham, Plymouth, South St. Paul, and Maple Plain all confirmed some level of operational impact — in Braham’s case, unknown actors used malware delivered over a wireless connection to shut down water plant operating controls. Crews across the affected communities fell back to manual operation, and no city reported any change in drinking water quality or safety.
The timing is hard to ignore. Just four days before the Minnesota incident, CISA updated its advisory on Iranian-affiliated actors exploiting internet-exposed programmable logic controllers (PLCs) — expanding the warning beyond Rockwell Automation devices to include Schneider Electric and Siemens equipment across the Water and Wastewater, Energy, and Government Services sectors.
On July 30, CISA issued additional guidance urging the Water and Wastewater Systems sector to protect OT against activity targeting PLCs, reinforcing that utilities need robust isolation and recovery plans so essential services can keep running under degraded conditions — whether through manual operation or alternative SCADA paths.
Attribution for the Minnesota attacks hasn’t been confirmed but has been labelled as “coordinated,” according to Minnesota’s official press release. The federal government has not given direct attribution either, but experts believe it is in Iran’s wheelhouse. Regardless of the attacker’s identity, the result is more than 30 communities placed at risk at once, and the line between ‘opportunistic’ and ‘coordinated’ access has effectively collapsed.
Why Water Utilities Keep Ending Up in the Crosshairs
Water is one of only four sectors the federal government designates as “lifeline” infrastructure — when it goes down, the damage doesn’t stay contained. A recent closed-door simulation of a coordinated attack on 5,000 U.S. water utilities showed how a single failure can trigger hospital evacuations, disrupt pharmaceutical manufacturing, and cascade into data centers and other critical services.
The sector’s exposure is structural. The EPA counts roughly 148,000 public water systems in the U.S., including about 50,000 community water systems, and more than 16,000 wastewater treatment facilities. It is a fragmented landscape where security maturity varies enormously and budgets are often thin. Only about 0.3% of the nation’s water systems participate in threat intelligence sharing through the WaterISAC, leaving most operators with little visibility into what adversaries already know about their infrastructure. Meanwhile, OT modernization has outpaced protection: legacy controllers, many with no built-in authentication, sit directly reachable from the internet.
That combination – high public impact, low security maturity, and thin collective defense – is exactly what makes water attractive to nation-state actors, ransomware groups, and hacktivists alike, even when their motives differ.
The Most Impactful Steps Utilities Can Take Now
Between the Minnesota response and CISA’s latest guidance, a clear, prioritized playbook emerges for OT operators — not aspirational best practices, but the same handful of gaps regulators and researchers (including our own Vedere Labs) keep finding.
Get complete visibility first
You can’t protect what you can’t see. That means a real-time, accurate inventory of every connected IT, OT, IoT, and IoMT asset — what’s on the network, what’s exposed to the internet, and where the risk actually sits. Operational technology can’t be treated as a downstream IT problem; these environments were never built to withstand a patient, well-resourced adversary.
Remove PLCs from direct internet exposure
Passive research following the Minnesota incident found internet-facing controllers reachable through cellular, wired, and fixed-wireless connections, many sitting behind consumer-grade cellular gateways. The underlying protocol many of these devices use for remote read/write functions often has no authentication by design — internet reachability alone creates risk, independent of any specific vulnerability. Restrict controller protocols to explicit allowlists and move cellular gateways behind private APNs or a protected VPN rather than exposing gateway administration publicly.
Segment and control access
Separate enterprise, engineering, vendor, SCADA, and controller networks from one another, and require individual accounts with multifactor authentication for all remote access. Weak or absent authentication at the protocol layer makes network isolation the primary practical control — the protocol itself won’t stop a connection once one is reachable.
Monitor continuously and keep manual fallback tested
Watch for unauthorized controller writes, mode changes, faults, and program transfers, and maintain approved offline copies of controller logic to compare against and restore from. Just as important: regularly test manual operation under a loss of SCADA or cellular communications. In Minnesota, that fallback is what kept the water safe — smaller systems still had the margin to switch to manual control. More automated environments may not have that same cushion.
Audit forgotten infrastructure
Expired certificates, unrenewed remote-access hostnames, and abandoned servers are more than housekeeping issues — they’re detection gaps. Unauthorized access is far harder to notice on an asset nobody is actively tracking as “in production.”
For most utilities, CISA’s Cybersecurity Performance Goals (CPG 2.0) remain the practical baseline: risk assessments, MFA, and network segmentation. EPA inspections continue to find that more than 70% of inspected systems fail basic cyber hygiene — including something as simple as removing former employees’ access and eliminating default passwords.
The Regulatory Gap Utilities Are Operating In
Unlike TSA’s authority over pipelines or NERC’s over the bulk electric system, the EPA lacks explicit cybersecurity regulatory authority over water utilities. Its 2023 effort to fold cybersecurity into sanitary surveys was challenged in court and withdrawn, leaving the agency reliant on Safe Drinking Water Act authorities that are inherently reactive rather than a proactive, sector-wide regime. CIRCIA will eventually require 72-hour incident reporting for covered critical infrastructure operators, but that rulemaking is still underway, with a final rule expected in fall 2026.
Until then, the exposure already exists — and utilities that wait for a regulatory mandate before addressing it are betting against the same class of adversary that just took down automated controls in more than 30 Minnesota communities.
Go deeper: Watch the anatomy of an attack on a fake water treatment plant. Forescout’s Vedere Labs caught one in our research honeypot:
Frequently Asked Questions
Did the Minnesota attacks affect drinking water safety?
No. Officials in all confirmed-affected communities — Plymouth, South St. Paul, Maple Plain, and Braham — reported no degradation in drinking water quality. Operators switched to manual control while automated systems were restored.
Who is behind the attacks?
Attribution hasn’t been publicly confirmed. The timing closely follows CISA’s July 22 update on Iranian-affiliated actors targeting internet-exposed PLCs, but officials have not tied the Minnesota incident to a specific actor.
What does CISA recommend water utilities do right now?
CISA’s July 30 guidance urges the sector to protect OT against activity targeting PLCs, maintain strong isolation between IT and OT networks, and keep recovery plans current enough that manual or alternative SCADA operation can sustain essential services if automated systems are compromised.
Why do so many attacks trace back to internet-exposed PLCs?
Many older controllers were designed for isolated industrial networks, not the open internet, and lack authentication on core read/write functions. Once a device is reachable, the protocol itself provides little resistance to unauthorized commands — which is why removing direct exposure and enforcing network segmentation are consistently the highest-impact fixes.
Is this only a risk for large utilities?
No — the opposite is often true. Smaller, resource-constrained utilities are frequently the ones running exposed legacy controllers with default credentials and consumer-grade remote access tools, making them attractive, lower-effort targets even though the potential public impact is just as serious.
What’s the single most important first step?
Complete, continuous visibility into every connected IT, OT, IoT, and IoMT asset. Every other control — segmentation, monitoring, access management — depends on first knowing what’s actually on the network and what’s exposed.